I sure wouldn’t want to be an upper level employee with Target this holiday season dealing with the ramifications from the recently reported credit card theft that hit the retailer. With potentially 40 million credit card numbers stolen and reports that some of those credit card numbers are already flooding the underground market, Target is already the, well…the target of one class action law suit filed by a customer. That will probably be just the first of many.
The news of the extraordinary theft was delivered earlier this week by security blogger David Krebs. Since the release of that news, the story continues to grow as more information is revealed and Target attempts damage control. The theft occurred during the period of November 27 through December 15 at the majority of Target’s 1747 stores. Online sales were not affected. Target confirmed the news the day after Krebs began reporting the news with an apology and warnings to its customers (Target calls customers guests), to monitor their credit cards information and also change PIN numbers on debit cards.
Today, in an attempt at damage control Target issued another apology to its guests and offered a 10% discount for all shoppers for this weekend, December 21 and December 22 as a gesture of good will, and a hope of getting customers back into its stores for the busy last shopping weekend before Christmas. Target is also offering free credit card monitoring for those affected as per the communication below:
“Yesterday we shared that there was unauthorized access to payment card data at our U.S. stores. The issue has been identified and eliminated. We recognize this has been confusing and disruptive during an already busy holiday season. Our guests’ trust is our top priority at Target and we are committed to making this right.
We want our guests to understand that just because they shopped at Target during the impacted time frame, it doesn’t mean they are victims of fraud. In fact, in other similar situations, there are typically low levels of actual fraud. Most importantly, we want to reassure guests that they will not be held financially responsible for any credit and debit card fraud. And to provide guests with extra assurance, we will be offering free credit monitoring services. We will be in touch with those impacted by this issue soon on how and where to access the service.
We understand it’s been difficult for some guests to reach us via our website and call center. We apologize and want you to understand that we are experiencing unprecedented call volume. Our Target teams are working continuously to build capacity and meet our guests’ needs.
We take this crime seriously. It was a crime against Target, our team members, and most importantly, our guests. We’re in this together, and in that spirit, we are extending a 10% discount – the same amount our team members receive – to guests who shop in U.S. stores on Dec. 21 and 22. Again, we recognize this issue has been confusing and disruptive during an already busy holiday season. We want to emphasize that the issue has been addressed and let guests know they can shop with confidence at their local Target stores.”
Meanwhile Krebs has reported that credit and debit card numbers stolen in the heist are flooding the underground black market already. That’s only logical now that the news is out. Thieves want to score while they can before banks and customers start shutting off credit cards. Reading the recent Krebs on Security article feels like reading an espionage thrillers and is enough to make your hair stand on end. Apparently the black marketers have a pretty sophisticated system for selling the stolen credit cards with a trial period that can even offer those purchasing the ill-gotten numbers a refund if a stolen credit card number has already been changed or cancelled.
Krebs himself helped one unnamed bank take a peak at that system and that bank discovered some credit cards it has issued compared to the some of the numbers that had been stolen. That reporting is excellent by Krebs, but it raises some serious questions if this information is so easily obtainable.
I would suspect we are going to hear much more about this story throughout the holiday season and after. This incident not only threatens consumers and Target, but you can bet that other retailers are very nervous about possible infiltration of their point-of-sale systems as well. If there is a silver lining to this, it is that consumers will be perhaps more cautious going forward, because a theft and a story of this magnitude threatens trust in the system that so many rely on.