UPDATE: Target Confirms Customers' Encrypted PINs were Obtained

By: WSAW Staff
By: WSAW Staff
More Video...

UPDATE: Fri 1:02 PM, Dec. 27, 2013

ATLANTA (AP) -- Target says that customers' encrypted PIN data was removed during the data breach that occurred earlier this month.

The company issued a statement Friday that additional forensic work has shown that encrypted PIN data was removed along with customers' names and card numbers. But Target says it believes the PIN numbers are still safe because the information was strongly encrypted. It says the PIN can only be decrypted when received by its independent payment processor.

A PIN number is the personal identification code used to make secure transactions on a credit or debit card.

Data connected to about 40 million credit and debit cards used at Target were stolen between Nov. 27 and Dec. 15.

Minneapolis-based Target says it is still in the early stages of investigating the breach.

--------------------------------------------------------------------
UPDATE: Mon 5:18 PM, Dec. 23, 2013

NEW YORK (AP) -- Target Corp. said the Department of Justice is investigating the security breach at the retailer that's being called the second largest such incident in U.S. history.

The DOJ declined to comment on whether it's investigating Target, the nation's second largest discounter.

Target also said that it's teaming up with the U.S. Secret Service in its own investigation. Target said the Secret Service has asked the company not to share many of the details of the probe.

Additionally, Target said that it held a conference call with the state attorneys general on Monday.

The investigations and the call come after Target said earlier this week that data connected to about 40 million credit and debit card accounts was stolen that began over the Thanksgiving weekend.

--------------------------------------------------------------------
UPDATE: Thurs 2:12 PM, Dec. 19, 2013

NEW YORK (AP) -- With less than a week until Christmas, a real-life Grinch has stolen the credit and debit card information of about 40 million Target shoppers.

Target says anyone who made purchases by swiping cards at terminals in its U.S. stores between Nov. 27 and Dec. 15 may have had their accounts exposed. The stolen data includes customer names, credit and debit card numbers, card expiration dates and the three-digit security codes located on the backs of cards.

The stolen information included Target store brand cards and major card brands such as Visa and MasterCard.

The data breach did not affect online purchases, the company said.
Here are some answers to the most common questions about the theft:

Q: I shopped at Target during that time. What should I do?

A: Check your credit card statements carefully. If you see suspicious charges, report the activity to your credit card companies and call Target at 866-852-8680. You can report cases of identity theft to law enforcement or the Federal Trade Commission.

You can get more information about identity theft on the FTC's website at www.consumer.gov/idtheft, or by calling the FTC, at (877) IDTHEFT (438-4338).

Q: How did the breach occur?

A: Target isn't saying how it happened. Industry experts note that companies such as Target spend millions of dollars each year on credit card security, making a theft of this magnitude particularly alarming.

Avivah Litan, a security analyst with Gartner Research, says given all the security, she believes the breach may have been an inside job.

Litan says Target's breach suggests that current security standards aren't working.

"It's really a wake-up call to the banking industry, but they never seem to wake up," she said.

James Lyne, global head of security research for the computer security firm Sophos, says something clearly went wrong with Target's security measures.

"Forty million cards stolen really shows a substantial security failure," he says. "This shouldn't have happened."

Q: Who pays if there are fraudulent charges on my account?

A: The good news is in most cases consumers aren't on the hook for fraudulent charges.

Credit card companies are often able to flag the charges before they go through and shutdown your card. If that doesn't happen, the card issuer will generally strip charges you claim are fraudulent off your card immediately.

And since the fraud has been tied to Target, it'll be the retailer that ultimately compensates the banks and credit card companies.

Q: How much is this going to cost Target?

A: It's too soon to tell. In addition to the fraud-related losses, banks may start charging Target a higher merchant discount rate, which is the amount retailers pay banks for providing debit and credit card services.

While the percentage difference may be tiny, it could result in steep costs given the volume of transactions Target does, Litan said.

Litan added that the company could also face class action lawsuits from consumers, though most of them will be meritless, and fines from federal agencies. When combined, the costs of the breach could be so steep that they actually prompt Target to raise prices., she said.

"The real winner in this is Wal-Mart," she said.

Q: How can I protect myself?

A: Like they say, cash is king. You can only lose what you're carrying, though admittedly many people may not feel safe walking around with a wad of bills in their pocket.

As stated before, credit card companies don't hold consumers liable for charges they don't make. Usually the worst thing consumers have to deal with is the hassle of getting a new credit card.

And the paper trail generated through credit card transactions can often make it easier do things such as return items you've purchased, or keep track of work-related expenses.

It's worth noting that while debit cards offer many of the same perks as credit cards, without the worry that you'll spend more than what's in your bank account, they often don't come with the same kind fraud protections.

As a result, those card holders may have a tougher time getting their money back if their number is stolen.

Q: How can future breaches be prevented?

A: Litan said an easy way to prevent fraud would be to eliminate the use of easily cloned magnetic strip cards and upgrade to the kind of microchip technology used in most other parts of the world.

But she said that banks have pushed back against the idea, because the microchip cards costs significantly more than the magnetic strip version and changing over all of the country's ATMs could drive the total costs into the billions of dollars.

Lyne said it's unclear if the use of microchip cards would have prevented the Target breach, since it's unclear how it happened, but that it certainly wouldn't hurt.

Q: Why is the Secret Service investigating?

A: While it's most famous for protecting the president, the Secret Service also is responsible for protecting the nation's financial infrastructure and payment systems. As a result, it has broad jurisdiction over a wide variety of financial crimes. It isn't uncommon for the agency to investigate major thefts involving credit card information.

--------------------------------------------------------------------
UPDATE: Thurs 8:42 AM, Dec. 19, 2013

Target has confirmed that a security breach of their credit and debit card transactions may have affected as many as 40 million cards. They released the following statement:

MINNEAPOLIS — December 19, 2013
Target today confirmed it is aware of unauthorized access to payment card data that may have impacted certain guests making credit and debit card purchases in its U.S. stores. Target is working closely with law enforcement and financial institutions, and has identified and resolved the issue.

“Target’s first priority is preserving the trust of our guests and we have moved swiftly to address this issue, so guests can shop with confidence. We regret any inconvenience this may cause,” said Gregg Steinhafel, chairman, president and chief executive officer, Target. “We take this matter very seriously and are working with law enforcement to bring those responsible to justice.”

Approximately 40 million credit and debit card accounts may have been impacted between Nov. 27 and Dec. 15, 2013. Target alerted authorities and financial institutions immediately after it was made aware of the unauthorized access, and is putting all appropriate resources behind these efforts. Among other actions, Target is partnering with a leading third-party forensics firm to conduct a thorough investigation of the incident.

More information is available at Target’s corporate website. Guests who suspect unauthorized activity should contact Target at: 866-852-8680.

--------------------------------------------------------------------
ORIGINAL STORY: Wed 5:43 PM, Dec. 18, 2013

(CNET) It's not just online transaction databases that are susceptible to attacks. Target is reportedly looking into the theft of millions of in-store credit card and debit card records from its databases.

Customers all over the United States were victimized, reported Brian Krebs, who cited people at two of the top 10 credit card issuers in the US.

Both of them said that the breach started on or around Nov. 29, the busy shopping day known as Black Friday, and extended to at least Dec. 6, and possibly as long as Dec. 15.

"The breach window is definitely expanding," an anti-fraud analyst in the US told Krebs. A data breach investigation firm representative who wished to remain anonymous said that they expect this breach to compare in scope to "some of the largest retail breaches to date."

An unknown number of customers who shopped at Target's physical stores are reportedly affected. Online customers are apparently not affected by the breach.

The investigation, which still has not been confirmed, has yet to reveal key factors in the breach such as what kind of information was targeted.


Join the Conversation!

To comment, the following rules must be followed:

  • No Obscenity, Profanity, Vulgarity, Racism or Violent Descriptions
  • No Negative Community Comparisons
  • No Fighting, Name-calling, or Personal Attacks
  • Multiple Accounts are Not Allowed
  • Stay on Story Topic

Comments may be monitored for inappropriate content, but the station is under no legal obligation to do so.
If you believe a comment violates the above rules, please use the Flagging Tool to alert a Moderator.
Flagging does not guarantee removal.

Multiple violations may result in account suspension.
Decisions to suspend or unsuspend accounts are made by Station Moderators.
Questions may be sent to comments@wsaw.com.
Please provide detailed information.
All comments must adhere to the WSAW.com discussion rules.

powered by Disqus
WSAW-TV 1114 Grand Ave. Wausau, WI 54403
Copyright © 2002-2014 - Designed by Gray Digital Media - Powered by Clickability 236464671 - wsaw.com/a?a=236464671
Gray Television, Inc.