Target confirms massive data breach

[digitalbabe]

From USA Today-check your statements for the period discussed:

Target says that its stores have been hit by a major credit-card attack involving up to 40 million accounts.

Chief Executive Officer Greg Steinhafel confirmed Thursday morning earlier reports that a brazen data breach had taken place. In a statement, Steinhafel said: "Target is working closely with law enforcement and financial institutions, and has identified and resolved the issue."

The retailer said that the unlawful access to customer information took place between Nov. 27 and Dec.15.

Earlier, the Secret Service confirmed to USA TODAY that it is investigating the massive data violation involving shoppers' personal credit-card information.

"The Secret Service will confirm it is investigating the incident at Target," spokesman Brian Leary said in a telephone interview Wednesday night. "We don't have any further comment because it's an ongoing investigation."

The breach began around Black Friday, the day after Thanksgiving and the busiest shopping day of the year.

The breach involves the theft of information stored on the magnetic stripe on the backs of cards used at nearly all of Target's stores around the country, according to the Krebs on Security website, who first reported the news.

KrebsOnSecurity.com is the website of Brian Krebs, a national computer security expert and former Washington Post reporter.

Target is based in Minneapolis and has almost 1,800 stores in the United States and 124 in Canada, according to its website.

James Issokson, vice president of MasterCard communications, said in an e-mail to USA TODAY that a question regarding the potential breach "at this point is best directed to Target."

An expert with a global firm that helps companies respond to and mitigate breaches said while he could not address the Target situation specifically, many companies — large and small — are typically under-prepared when they face a breach.

Most important is that the potential breach be addressed quickly, to help get information out to those affected and to regulators, to bring in the right experts to address the breach (such as forensics experts who can stop cyber attacks) and to help preserve the public's trust in the company, said Mike Donovan, Global Focus Group Leader for Beazley Breach Response, headquartered in London.

"We see breaches across all sizes of companies," said Donovan, who is based in San Francisco. "You see the stories about the big ones in the news, but breaches are affecting companies all across the board."

Beazley recently responded to its 1000th breach and the company has seen a "significant number" of large breaches in the last four or five years, Donovan said.

It happens all the time, every day, with retailers, health care organizations, schools and other operations, he said.

"Any company that handles personal data is vulnerable," Donovan said.

The potential breach does not appear to involve online purchases, Krebs reports. It appears the type of data stolen would allow thieves to create counterfeit credit cards and, if pin numbers were intercepted, would also allow thieves to withdraw cash from ATM machines, according to Krebs.

Visa did not respond to e-mails or telephone messages left with its corporate office.

Kim Hjelmgaard contributed to this story from London

 

[bigrob]

I've seen a documentary where the card swipe machine have been tampered with and actually have a modem inside that transmits the card details as soon as it's swiped

scary stuff

 

[darczap]

I've seen a documentary where the card swipe machine have been tampered with and actually have a modem inside that transmits the card details as soon as it's swiped

scary stuff

Yup, very real stuff. The good thing is the magnetic strips don't contain info. like your social security number but it does contain obviously the cc data, your name and your address. I think what really stinks about this whole thing is that debit cards were compromised. The thieves could potentially recreate a card and withdraw money from an ATM.

Three Target exclusives were released in that time frame. And I bought them all. Not good at all.

 

[digitalbabe]

Yep, definitely check your statements, because for most banks, you have a certain window of time to dispute an illegitimate charge.

 

[Klownicle]

Thankfully, I only just purchased the Elysium steelbook, so I wasnt a 11/18 to 12/18 shopper. No purchases between those dates. I wonder if this includes Online transactions/InStore Pickups etc.

 

[darczap]

Thankfully, I only just purchased the Elysium steelbook, so I wasnt a 11/18 to 12/18 shopper. No purchases between those dates. I wonder if this includes Online transactions/InStore Pickups etc.

In store purchases only I think. The online purchases most likely tokenize your credit card data which doesn't do anything for fraudsters, but the raw cc data from in store purchases is like a gold mine for them.

 

[apsmith21]

Everything I have read and seen thus far state in-store purchases only.

The breach could include any credit card used, bank / debit cards and the target red card.

So the best advice they have is to wait, watch your account and report any suspicious activity immediately.

 

[Leshita]

Is this America only? Canadian stores are safe, right? :'(

 

[darczap]

Is this America only? Canadian stores are safe, right? :'(

Looks like Canada is safe.

http://techland.time.com/2013/12/19/the-target-credit-card-breach-what-you-should-know/

You’re not in any danger if you shopped at Target’s website, or one of the company’s Canada stores.

 

[Xavier]

I have checked all three of my cards thankfully nothing so far. I made 4-5 large transactions during that time. Hopefully they leave my numbers alone since one of mine had already been stolen this year which made things very stressful for me and almost ruined a vacation

 

[digitalbabe]

Good idea guys, in this day and age, sadly this happens more and more frequently. So since many of us shop at huge stores, it's a good idea to review your statements and make sure all is ok. I once purchased something from a very well known company and the next day I noticed a $900+ authorization for exercise equipment in a city I'd never been. I called immediately, and was then told my bank card info along with millions of others' had been swiped from a gateway that was not as safe as it should have been. We can't get paralyzed with fee (we all shop at brick and mortar stores and online frequently), but I'd say just remain aware. Unfortunately these hackers use more and more sophisticated mechanisms to try and get over. With the digital age, come different kind of 'breaches' I think.

 

[Xavier]

Target to offer shoppers a 10% discount this weekend as a "we are sorry " to customers and to try and regain lost sales from upset customers .

I wont be taking part but wanted to share

 

[cbs777]

Received an e-mail from my bank stating that they will temporarily limit my account to $100 ATM withdrawals, and up to $300 on transactions because of this breach. I've always been diligent about checking my account, now I'm checking it at least 10 times a day.

My second account debit card had been compromised about 5 days ago, my bank called me and asked me if I had tried to make these particular purchases. They went over at least 15 transactions that were attempted in a 5 minute span, luckily I keep $0 balance in this account. I use this strictly for online purchases if a company doesn't take paypal, such as Amazon etc, or for use in a restaurant or fast food place.

The problem with my second account is, I don't know where the attempted fraud came from, locally or one of the national or international online retailers I have my card on file with.

 

[Ricker]

My bank just called me stating they cancelled my debit card and reissued me a new one. Great, so now I get to shop like an elderly person and use a checkbook or a change purse.

 

[digitalbabe]

Ricker, usually you can go to your local branch (or if you have a joint account, they could go), to get a temp card. My debit card has been reissued several times over the years, because of breaches from a variety of sources...crazy new electronic world, ha!

 

[tono06]

thats why i check my bank status twice a day....morning and night, and they always call me if suspicious activity before release founds...i'm happy with them...

 

[digitalbabe]

Yeah, heard a couple of other tidbits of info today-and keep checking for a while because one of the things the scammers do is steal the card info, and then either resell your info on black market or, use the card at a later time. If you are very concerned, have your card cancelled and get a new one.


::: Staff/Community Manager :::

 

[darczap]

Here is a link from Target's website with FAQ's about the breach.

https://corporate.target.com/about/shopping-experience/payment-card-issue-FAQ.aspx#q5861

 

[Ricker]

I think Target should send everybody 1K for the Holidays.