Target may have gotten what it wanted on May 7 when a U.S. District Court judge green-lighted its $19 million settlement with MasterCard, but the win may come back to haunt it and other retailers.

Card issuers now have until May 20 to decide if they'll accept the highly-criticized settlement offer related to Target's massive 2013 data breach, but concerns about the settlement's size, the exclusion of card issuers from the negotiations, and the requirement to forfeit future rights to sue Target may fuel a growing crusade to make Target and other retailers liable for the havoc their data breaches wreak.

At least 90% of the eligible MasterCard issuers have to accept the settlement by the deadline in order for it to proceed, but now the question is whether they will do so. Despite ruling that MasterCard and Target were free to exclude issuers from the settlement negotiations because the issuers weren't a certified class, which would have made it a class-action suit, U.S. District Court Judge Paul Magnuson expressed concern about the settlement's fairness.