Target: 40M Accounts May Be Involved In Breach
MINNEAPOLIS (AP/WCCO) -- Target's data-security nightmare threatens to drive off holiday shoppers during the company's busiest time of year.
The nation's second-largest discounter acknowledged Thursday that data connected to about 40 million credit and debit card accounts was stolen as part of a breach that began over the Thanksgiving weekend.
The theft marks the second-largest credit card breach in U.S. history, exceeded only by a scam that began in 2005 involving retailer TJX Cos. and affected at least 45.7 million card users.
Target's disclosure came a day after reports that the company was investigating a breach.
Customers who made purchases by swiping their cards at its U.S. stores between Nov. 27 and Dec. 15 may have had their accounts exposed. The stolen data included customer names, credit and debit card numbers, card expiration dates and the embedded code on the magnetic strip on back of the card, Target said.
There was no indication that the three- or four-digit security numbers visible on the back of the card were affected.
The data breach did not affect online purchases, the company said.
Target has not disclosed exactly how the breach occurred but said it has fixed the problem.
Large companies spend millions of dollars each year on credit-card security measures. Given the company's heavy security, the theft may have been an inside job, said Avivah Litan, a security analyst with Gartner Research.
"The fact this breach can happen with all of their security in place is really alarming," Litan said.
Jason Oxman, CEO of the Electronics Transaction Association, which represents the payments technology industry, said past data breaches have been "heavily organized and sophisticated."
Last year, global credit and debit card fraud losses reached $11.27 billion, up 11. 4 percent over the previous year, according to The Nilson Report, which tracks global payments. And while credit and debit card fraud has been on the rise, it's because the overall payment industry has expanded. In fact, Nilson's publisher David Robertson said credit and debit card fraud still accounts for less than 6 cents of every $100 spent.
Target, which has almost 1,800 stores in the U.S. and 124 in Canada, said it immediately told authorities and financial institutions once it became aware of the breach on Dec. 15. The company is teaming with a third-party forensics firm to investigate and prevent future problems.
The credit card breach poses a serious problem and threatens to scare away shoppers who worry about the safety of their personal data.
"This is close to the worst time to have it happen," said Jeremy Robinson-Leon, a principal at Group Gordon, a corporate and crisis public relations firm. "If I am a Target customer, I think I would be much more likely to go to a competitor over the next few days, rather than risk the potential to have my information be compromised."
In the Twin Cities metro, shoppers had trouble recalling how many times they shopped at Target during the breach period. Ryan Dietrich, of Maple Grove, says he shops at the discounter on a daily basis.
"I think three times this week I end up forgetting something, I go back in and pick more stuff up," he said.
Target advised customers Thursday to check their statements carefully. Those who see suspicious charges on the cards should report it to their credit card companies and call Target at 866-852-8680. Cases of identity theft can also be reported to law enforcement or the Federal Trade Commission.
"Target's first priority is preserving the trust of our guests, and we have moved swiftly to address this issue, so guests can shop with confidence," Chairman, President and CEO Gregg Steinhafel said Thursday in a statement.
Many displeased customers left angry comments on the company's Facebook page. Some threatened to stop shopping at the store. Many complained they could not get through to the call center and could not get on Target's branded credit card website. The company apologized and said it was "working hard" to resolve the issue and adding more workers to field calls and fix website issues.
Christopher Browning, of Chesterfield, Va., said he was the victim of credit card fraud earlier this week and believes it was tied to a purchase he made at Target with his Visa card on Black Friday. When he called Visa on Thursday, the card issuer could not confirm his suspicions. He said he has not been able to get through to Target's call center.
On Monday, Browning received a call from his bank's anti-fraud unit saying that there were two attempts to use his credit card in California — one at a casino in Tracey, Calif., for $8,000 and the other at a casino in Pacheco, for $3,000. Both occurred on Sunday and both were denied. He canceled his credit card and plans to use cash.
"I won't shop at Target again until the people behind this theft are caught or the reasons for the breach are identified and fixed," he said.
Brianna Byrnes, of Kansas City, Mo., a student at the University of Missouri-Kansas City and a call center worker, said she made a Target purchase during the affected period. The situation made her "a little bit" nervous, but she still planned to shop for toys at the store.
"I've never had anyone steal my identity. I guess it's taking a risk."
Some shoppers, like Jill Steeves of Minneapolis, feel sympathetic toward Target.
"Target's a really great corporate entity here in the Twin Cities," she said, "and I'm really hoping they're able to work through this."
Target's stock dropped more than 2 percent, or $1.40, to $62.15 on Thursday.
The incident is particularly troublesome for Target because it has used its store-branded credit and debit cards as a marketing tool to attract shoppers with a 5 percent discount.
During an earnings call in November, the company said some 20 percent of store customers as of October have the Target-branded cards. In fact, households that activate a Target-branded card have increased their spending at the store by about 50 percent on average, the company said.
"This is how Target is getting more customers in the stores," said Brian Sozzi, CEO and Chief Equities Strategist. "It's telling people to use the card. It's been a big win. If they lose that trust, that person goes to Wal-Mart."
TJX Cos., which runs stores such as T.J. Maxx and Marshall's, had a breach that began in July 2005 and exposed at least 45.7 million credit and debit cards to possible fraud. The breach was not detected until December 2006.
Without anyone noticing, one or more intruders installed code on the discount retailer's systems to methodically collect and transmit account data from millions of cards.
In 2009, TJX agreed to pay $9.75 million in a settlement with multiple states.
In 2011, an even larger hack hit Sony, which had to rebuild trust among PlayStation Network gamers after hackers compromised personal information, including credit card data, on more than 100 million user accounts.
Litan doubts the breach will have much effect on Target's sales, noting that TJX launched sales promotions immediately following the news of its breach. The promotions increased sales.
"People care more about discounts than security," Litan said.
In the end, Target could end up losing the most in all of this. For shoppers, any fraudulent charges should be covered by the credit card companies. But those credit card companies could then send a bill to Target.
Answers To Questions About The Target Data Breach
Q: I shopped at Target during that time. What should I do?
A: Check your credit card statements carefully. If you see suspicious charges, report the activity to your credit card companies and call Target at 866-852-8680. You can report cases of identity theft to law enforcement or the Federal Trade Commission.
You can get more information about identity theft on the FTC's website at www.consumer.gov/idtheft, or by calling the FTC, at (877) IDTHEFT (438-4338).
Q: How did the breach occur?
A: Target isn't saying how it happened. Industry experts note that companies such as Target spend millions of dollars each year on credit card security, making a theft of this magnitude particularly alarming.
Experts disagree about how the breach might have happened.
Avivah Litan, a security analyst with Gartner Research, says given all the security, she believes the breach may have been an inside job.
But thefts of this size are too big to be the work of company employees, says Ken Stasiak, founder and CEO of Secure State, a Cleveland-based information security firm that investigates data breaches like this one. Stasiak says that such breaches are generally perpetrated by organized crime or an overseas, state-sponsored hacker group.
Stasiak's theory is that the hackers were able to breach Target's main information hub and then wrote a code that gave them access to the company's point of sale system and all of its cash registers. That access allowed the hackers to capture the data from shoppers' cards as they were swiped.
James Lyne, global head of security research for the computer security firm Sophos, says something clearly went wrong with Target's security measures.
"Forty million cards stolen really shows a substantial security failure," he says. "This shouldn't have happened."
Q: Who pays if there are fraudulent charges on my account?
A: The good news is in most cases consumers aren't on the hook for fraudulent charges.
Credit card companies are often able to flag the charges before they go through and shutdown your card. If that doesn't happen, the card issuer will generally strip charges you claim are fraudulent off your card immediately.
And since the fraud has been tied to Target, it'll be the retailer that ultimately compensates the banks and credit card companies.
Q: How can I protect myself?
A: Like they say, cash is king. You can only lose what you're carrying, though admittedly many people may not feel safe walking around with a wad of bills in their pocket.
As stated before, credit card companies don't hold consumers liable for charges they don't make. Usually the worst thing consumers have to deal with is the hassle of getting a new credit card.
And the paper trail generated through credit card transactions can often make it easier do things such as return items you've purchased, or keep track of work-related expenses.
It's worth noting that while debit cards offer many of the same perks as credit cards, without the worry that you'll spend more than what's in your bank account, they often don't come with the same kind fraud protections.
As a result, those card holders may have a tougher time getting their money back if their number is stolen.
Q: How much is this going to cost Target?
A: It's too soon to tell. In addition to the fraud-related losses, banks may start charging Target a higher merchant discount rate, which is the amount retailers pay banks for providing debit and credit card services. While the percentage difference may be tiny, it could result in steep costs given the volume of transactions Target does, Litan says.
Litan added that the company could also face class action lawsuits from consumers, though most of them will be meritless, and fines from federal agencies. When combined, the costs of the breach could be so steep that they actually prompt Target to raise prices, she says.
"The real winner in this is Wal-Mart," she says.
Q: Can the bad guys be caught?
A: Stasiak says that given the sophistication of this attack, there's only about a 5 percent chance that the perpetrators will eventually be caught and prosecuted.
He notes that in cases like this, it's hard to determine where the attack originated and given the large mass of information involved it's not going to be found housed on someone's home computer.
Q: How can future breaches be prevented?
A: Litan says an easy way to prevent fraud would be to eliminate the use of easily cloned magnetic strip cards and upgrade to the kind of microchip technology used in most other parts of the world.
But she says banks have pushed back against the idea, because the microchip cards cost significantly more than the magnetic strip version and changing over all the country's ATMs could drive the total costs into the billions of dollars.
Lyne says it's unclear if the use of microchip cards would have prevented the Target breach, since it's unclear how it happened, but that it certainly wouldn't hurt.
Q: Why is the Secret Service investigating?
A: While it's most famous for protecting the president, the Secret Service also is responsible for protecting the nation's financial infrastructure and payment systems. As a result, it has broad jurisdiction over a wide variety of financial crimes. It isn't uncommon for the agency to investigate major thefts involving credit card information.
(© Copyright 2013 The Associated Press. All Rights Reserved. This material may not be published, broadcast, rewritten or redistributed.)
