Target stores had credit card frauds all over the country! Outrageous!

Debit and credit cards stolen in Target breach reportedly for sale in underground black markets
Published December 22, 2013
FoxNews.com


Credit and debit card accounts stolen during a security breach involving retailer Target have reportedly flooded underground black markets, going on sale in batches of one million cards.

The cards are being sold from around $20 to more than $100 each, KrebsOnSecurity reports.

The security news site said it spoke to a fraud analyst at a major bank who said his team was able to buy a portion of the bank’s accounts from an online store advertised in cybercrime forums as a place where thieves can buy stolen cards.

The analyst was not identified, but said the purchase was made before Target admitted Thursday that data connected to about 40 million credit and debit card accounts was stolen as part of a breach that began over the Thanksgiving weekend.

According to KrebsOnSecurity, there are hundreds of online stores selling stolen credit and debit cards from banks worldwide.

If the sites sell quality “dumps,” which is data stolen from the magnetic stripe on the backs of the cards, it can be used by thieves to clone the cards for use in stores. If the “dumps” contain the PIN numbers to those accounts, thieves can use cloned cards to remove cash out of victims’ bank accounts, KrebsOnSecurity reports.

To help reduce any unauthorized activity on Chase bank accounts, the company put some temporary restrictions on debit cards affected by the breach.

Chase contacted about 2 million affected debit card members Saturday and said they would be limited to a maximum of $100 cash withdrawals and $300 in purchases per day. Less than 10 percent of Chase customers are affected, said spokeswoman Kristin Lemkau.

The Target data theft is the second-largest credit card breach in U.S. history, exceeded only by a scam that began in 2005 involving retailer TJX Cos. That incident affected at least 45.7 million card users.

Target disclosed the theft a day after reports that the company was investigating a breach. The retailer's data-security troubles and its ensuing public relations nightmare threaten to drive off holiday shoppers during the company's busiest time of year.

Potential victims of credit card fraud tied to the breach said they had trouble contacting the Target through its website and call centers.

Angry Target customers expressed their displeasure in comments on the company's Facebook page. Some even threatened to stop shopping at the store.

Target's CEO Gregg Steinhafel apologized through a statement issued on Friday. The retailer also said it's working hard to resolve the problem and is adding more workers to field calls and help solve website issues. And the discounter began offering 10 percent off for customers who shop in its stores on Saturday and Sunday and free credit-monitoring services to those who've been affected by the issue.

On Friday, Target reiterated that the stolen data included customer names, credit and debit card numbers, card expiration dates and the embedded code on the magnetic strip found on the backs of cards, Target said.

There was no indication the three- or four-digit security numbers visible on the back of the card were affected, Target said. It also said Friday there was no indication that the stolen data included a customer's birth date or social security number. The data breach did not affect online purchases, the company said.

Target also said it didn't believe that PIN numbers to customers' debit cards have been compromised.

Target hasn't disclosed exactly how the breach occurred but said it has fixed the problem.

Target, which has almost 1,800 stores in the U.S. and 124 in Canada, said it immediately told authorities and financial institutions once it became aware of the breach on Dec. 15. The company is teaming with a third-party forensics firm to investigate and prevent future problems.

[You must be registered and logged in to see this link.]


PIN numbers removed but data ‘safe and secure’ in security breach, Target says
Published December 27, 2013
FoxNews.com




Target said Friday that debit-card PIN numbers were among the financial information stolen from millions of customers who shopped at the retailer earlier this month.

The company said the stolen personal identification numbers, which customers type in to keypads to make secure transactions, were encrypted and that this strongly reduces risk to customers.

In addition to the encrypted PINs, customer names, credit and debit card numbers, card expiration dates and the embedded code on the magnetic strip on back of the cards were stolen from about 40 million credit and debit cards used at Target between Nov. 27 and Dec. 15.

"The PIN information was fully encrypted at the keypad, remained encrypted within our system, and remained encrypted when it was removed from our systems," Molly Snyder, a spokeswoman from the company, said in a statement.

The announcement comes as federal lawsuits are beginning to trickle in from customers around the U.S. The Department of Justice told FoxNews.com Friday that it is investigating the Target data breach. Target said that it's cooperating with the DOJ's probe.

However, Gartner security analyst Avivah Litan said Friday that the PINs for the affected cards are not safe and people "should change them at this point."

By Monday evening, more than a dozen Target customers had filed federal lawsuits, with some accusing Target of negligence in failing to protect customer data. The recent security breach involving about 40 million credit and debit card accounts.

Target has been trying to deal with fallout from the breach during what is typically the busiest shopping season of the year.

Target has said that it told authorities and financial institutions once it became aware of the breach on Dec. 15. The company issued an apology to customers and doubled the number of workers taking calls from customers around the clock. It also offered 10 percent off to customers who wanted to shop in its stores on Saturday and Sunday and free credit-monitoring services to those who are affected by the issue.

But there are early signs that some shoppers are scared off by the breach.

Before this incident, Target had a chance of at least a decent Christmas. Now, it will be mediocre at best," said Craig Johnson, president of Customer Growth Partners, a retail consultancy.

Target explained in Friday’s statement that its systems do not store PIN information and these numbers can only be decrypted by an external payment processor.

"The most important thing for our guests to know is that their debit card accounts have not been compromised due to the encrypted PIN numbers being taken," the statement said.

[You must be registered and logged in to see this link.]