Breach goes from bad to worse for Target and its customers

Company now says up to 70 million cards exposed -- up from 40 million -- and that hackers accessed more data than previously thought

Target's acknowledgement Friday that personal data of 70 million people, not 40 million as previously thought, may have been exposed to hackers in a recent data breach raises new questions about the incident and how it could affect victims.

Target today also said that an ongoing investigation of the data breach has revealed that "guest information" such as names, mailing addresses, phone numbers, and email addresses of customers may have been accessed by the same thieves who hacked into its systems last month.

Much of the exposed data is "partial in nature," the company said in a statement this morning. In cases where a customer email address is available, Target said it would attempt to contact affected individuals.

"We know that it is frustrating for our guests to learn that this information was taken and we are sorry they are having to endure this," said Target chairman and CEO Gregg Steinhafel in the statement.

Target in mid-December revealed that hackers had broke into its systems between Nov. 27 and Dec. 15 and accessed data on up to 40 million debit and credit cards. At the time, Target said that hackers gained access to cardholder names, credit or debit card numbers, card expiration dates and CVV security codes.

Target now says that its subsequent investigation found that data from 30 million more cards was exposed. "This theft is not a new breach, but was uncovered as part of the ongoing investigation," the company said.

The update shows that the breach exposed data on about one third of the adult population of the United States, noted James Huguelet, and independent security consultant who specializes in retail security. "It now implies that consumers who shopped at Target outside of the approximately one month the breach was active have now become potentially affected by this breach," he said. Target's statement suggests that in some cases, only an individual's e-mail address might have been compromised, while in others, the mailing address might have been exposed. Huguelet said the "partial" exposure implies "that multiple systems containing different types of information were compromised [though] that's purely speculative at this point."

Hackers using the stolen information can now target victims with highly sophisticated spear-phishing attacks Huguelet warned.

"I can see a criminal being able to create a very effective attack with each e-mail sent having been customized to include the target's name, address, and phone number. This could very well lead to a massive wave of identity theft across the United States," he said.

Huguelet suggested that all Target customers accept the retailer's offer to provide free credit monitoring, though he added, "I'm surprised that Target is not making this available immediately." Attacks could already be underway and the credit monitoring may come too late for some victims, he said.

Steve Ward, a spokesman for security vendor Invincea, said Target customers should already be on high alert for phishing attacks. The stolen data allows attackers to craft very convincing emails in attempts to pry loose sensitive data.

"Seventy million active email addresses is a treasure trove for cyber criminal. They now have emails they know are active and linked to Target," he said. Where possible, he suggests that individuals with email addresses linked to Target deactivate them.

If the email address is too difficult to change, individuals have to be continually on the lookout for phishing attempts, not just for days, but for months and perhaps years as well, he said.

Credit and debit card information stolen from Target is already being used in new ways. Compromised cards are being marketed online with information on the state, city and ZIP code of the Target store where they were used.

Fraud experts suggest that the location information will likely allow buyers of the stolen data to use spoofed versions of cards issued to people in their immediate vicinity.

Local use of a card makes it more likely that crooks can use it for a longer period of time because fraud detection tools used by banks and other card issuers use locations and frequency of card use to determine potential criminal activity. Banks often decline transactions or require additional authentication only for card transactions that originate from new or unexpected locations.

The breach could be very costly for Target, especially considering the findings of its investigation. TJX and Heartland were hit with similar massive attacks have so far paid well over $100 million in breach-related costs, many in relation to outside investigations.

In the statement today, Target said it expects fourth-quarter sales and earnings to be substantially lower than the results expected before the breach was discovered.

The adjusted earning per share for the fourth quarter is now $1.20 to $1.30 compared to prior guidance of $1.50 to $1.60. Sales during the quarter are now expected to be nearly 2.5% lower than previously expected.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan, or subscribe to Jaikumar's RSS feed . His email address is jvijayan@computerworld.com.

Read more about cybercrime and hacking in Computerworld's Cybercrime and Hacking Topic Center.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Show Comments

Latest Videos

Launch marketing council Episode 5: Retailer and supplier

In our fifth and final episode, we delve into the relationship between retailer and supplier and how it drives and influences launch marketing strategies and success. To do that, we’re joined by Campbell Davies, group general manager of Associated Retailers Limited, and Kristin Viccars, marketing director A/NZ, Apex Tool Group. Also featured are Five by Five Global managing director, Matt Lawton, and CMO’s Nadia Cameron.

More Videos

The best part: optimizing your site for SEO enables you to generate high traffic, and hence free B2B lead generation. This is done throug...

Sergiu Alexei

The top 6 content challenges facing B2B firms

Read more

Nowadays, when everything is being done online, it is good to know that someone is trying to make an improvement. As a company, you are o...

Marcus

10 lessons Telstra has learnt through its T22 transformation

Read more

Check out tiny twig for comfy and soft organic baby clothes.

Morgan mendoza

Binge and The Iconic launch Inactivewear clothing line

Read more

NetSuite started out as a cloud-based provider of Enterprise Resource Planning software or as NetSuite solution provider, which companies...

talalyousaf

NetSuite to acquire Bronto's digital marketing platform for US$200m

Read more

Thanks for sharing this post, its really good information I get through this blog.CDPO Online Exam Training

Infosectrain01

3 ways Booking.com is improving its B2B marketing game

Read more

Blog Posts

Getting privacy right in a first-party data world

With continued advances in marketing technology, data privacy continues to play catchup in terms of regulation, safety and use. The laws that do exist are open to interpretation and potential misuse and that has led to consumer mistrust and increasing calls for a stronger regulatory framework to protect personal information.

Furqan Wasif

Head of biddable media, Tug

​Beyond greenwashing: Why brands need to get their house in order first

Environmental, Social and (Corporate) Governance is a hot topic for brands right now. But before you start thinking about doing good, Craig Flanders says you best sort out the basics.

Craig Flanders

CEO, Spinach

​The value of collaboration: how to keep it together

Through the ages, from the fields to the factories to the office towers and now to our kitchen tables, collaboration has played a pivotal role in how we live and work. Together. We find partners, live as families, socialise in groups and work as teams. Ultimately, we rely on these collaborative structures to survive and thrive.

Rich Curtis

CEO, FutureBrand A/NZ

Sign in