TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Target stores hit by data breach affecting 40 million cards

108 pointsby oulipianover 11 years ago

21 comments

jrochkind1over 11 years ago
&gt; <i>We have determined that the information involved in this incident included customer name, credit or debit card number, and the card’s expiration date and CVV (the three-digit security code).</i><p><a href="https://corporate.target.com/discover/article/Important-Notice-Unauthorized-access-to-payment-ca" rel="nofollow">https:&#x2F;&#x2F;corporate.target.com&#x2F;discover&#x2F;article&#x2F;Important-Noti...</a><p>CVV&#x2F;CSC, eh? The whole point of CSC is it should be non-stored and therefore much harder to steal than the CC#, right? Apparently that didn&#x27;t work. Has CSC accomplished anything other than giving users more random-looking numbers they have to enter in online forms?
评论 #6936235 未加载
评论 #6936008 未加载
评论 #6937928 未加载
评论 #6936844 未加载
geolistoover 11 years ago
When I read about massive data breaches such as these it makes me wonder why we don&#x27;t have a system in place to where we as the customer can generate a unique authorization code for a one-time charge to our cards without having to actually reveal our credit card information.<p>It&#x27;s bad enough that someone can buy a card reader and walk down a sidewalk and capture credit card data by just being within a few feet of someone.
评论 #6934589 未加载
评论 #6934570 未加载
评论 #6935348 未加载
maxericksonover 11 years ago
Brief earlier discussion: <a href="https://news.ycombinator.com/item?id=6930258" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=6930258</a><p>Target says the data is limited to cards used in the U.S. during the last few weeks:<p><a href="https://corporate.target.com/discover/article/Important-Notice-Unauthorized-access-to-payment-ca" rel="nofollow">https:&#x2F;&#x2F;corporate.target.com&#x2F;discover&#x2F;article&#x2F;Important-Noti...</a>
Lagged2Deathover 11 years ago
Can&#x27;t get to the Target Visa site (<a href="http://rcam.target.com" rel="nofollow">http:&#x2F;&#x2F;rcam.target.com</a>) even though downforeveryoneorjustme.com says it&#x27;s up. Hm.<p>A few years ago, the Target Visa card had actually pioneered a move toward chipped credit cards. My Target card was the only chipped credit card I had, though, and AFAIK even my local Target stores were never equipped with chip-reading card readers. When my card expired, the replacement didn&#x27;t have a chip.<p>It bothers me very much to realize that even though there was nothing I reasonably could have done to protect myself (except avoid credit cards entirely), this will ultimately be my problem to deal with. Not Target&#x27;s problem. Not really. Not in the same way that it&#x27;s mine.<p><i>I&#x27;m</i> expected to &quot;take... steps ... to protect [myself] against potential misuse of [my] credit and debit information.&quot; [1]<p>I realize that this is just the way the system works, but why does it work that way? The credit card system, instead of making the investments necessary to really secure credit card transactions, has externalized much of the tricky fraud-detection work onto the card users.<p>[1] <a href="https://corporate.target.com/discover/article/Important-Notice-Unauthorized-access-to-payment-ca" rel="nofollow">https:&#x2F;&#x2F;corporate.target.com&#x2F;discover&#x2F;article&#x2F;Important-Noti...</a>
评论 #6936140 未加载
评论 #6936425 未加载
jusben1369over 11 years ago
FWIW here&#x27;s the best early analysis I&#x27;ve seen in terms from an industry perspective: <a href="http://blogs.gartner.com/avivah-litan/2013/12/19/what-can-we-learn-from-the-target-breach/" rel="nofollow">http:&#x2F;&#x2F;blogs.gartner.com&#x2F;avivah-litan&#x2F;2013&#x2F;12&#x2F;19&#x2F;what-can-we...</a>
评论 #6936182 未加载
mmlover 11 years ago
Reminds me of when Best Buy discovered people wardriving their parking lots and plucking CC#&#x27;s out of the air via their unencrypted, wireless POS network. Surprised Target got hit, they&#x27;re pretty rabid about security&#x2F;loss prevention (internal and external).
评论 #6937388 未加载
tibbonover 11 years ago
How does PCI compliance not cover these things? Is Target liable for losses here?<p>It would seem to me that if you can&#x27;t secure the data, you shouldn&#x27;t keep it (which is the reason I use stuff like Stripe . I don&#x27;t want to see the card number).
评论 #6937610 未加载
评论 #6938110 未加载
rwhitmanover 11 years ago
My wife just got the Target Red debit card a few weeks ago, after a number of protests from me about security loopholes. She seemed to think getting 5% off of all purchases for bestowing the ability to a 3rd party to deduct money from your bank account at will is worth the risk of someone maliciously draining your bank account one day. Going to use this for a bit of &quot;I told you so&quot; nagging today
评论 #6936262 未加载
eugmillover 11 years ago
Anybody have any idea if there is a way to tell if your card was part of the breach? I have a family member who shopped at target during the dates mentioned.<p>I&#x27;m wondering what percentage of transactions were affected. Is 40 million 90%? 50%? There&#x27;s no way to tell. It&#x27;d be nice if we knew whether or not to report it to the bank.
评论 #6934989 未加载
评论 #6937535 未加载
dude3over 11 years ago
The funny thing is the day that this was happening they were trying to sign me up for their checking account program. Where I give them my checking account info and I save 5% on every purchase. They gave me the hard sell too and wouldn&#x27;t quit. I then conveniently typed in my pin so I&#x27;m f&#x27;d.
ck2over 11 years ago
Theft like this can happen on even the most secure designs but why did it take TWO WEEKS to be discovered?
评论 #6934609 未加载
tokenadultover 11 years ago
I&#x27;ve never liked Target for its intrusive tracking of customer spending[1] through their branded credit cards and other loyalty card schemes, because those never add any value for me. (I grew up shopping at the third Target store in the whole country, my sister used to work at Target, and we live a short walk from a Super Target, but the company&#x27;s emphasis on gathering data over genuine customer service[2] turns me off.) Because Target is the closest brick and mortar store to our house for many kinds of items, we still buy things there. I usually try to pay in cash. I&#x27;ll have to check our credit-card records [sigh] and see what&#x27;s going on in our accounts.<p>[1] <a href="http://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/" rel="nofollow">http:&#x2F;&#x2F;www.forbes.com&#x2F;sites&#x2F;kashmirhill&#x2F;2012&#x2F;02&#x2F;16&#x2F;how-targe...</a><p>[2] Personal anecdote alert: Target once had an in-house captive brand (not a Target brand, but a brand available in no other store) of &quot;oven bakeware&quot; that didn&#x27;t even meet the Uniform Commercial Code warranty of merchantability, as it would shatter if you used it in an oven to bake something. We found that out just before a meal when we were all hungry. The local store gave us all kinds of run-around about simply refunding our money for the defective product. That was ill-timed for Target, as one of my wife&#x27;s students had just given us a gift certificate for Sam&#x27;s Club, and we discovered that the much-maligned Sam&#x27;s Club is better about returns and about customer service in general than Target. We have shifted THOUSANDS of dollars a year from Target, my home-town store I grew up with, to Sam&#x27;s, the store everyone is inclined to decry, in the years since then. When a store sells a defective product and doesn&#x27;t make that right, I don&#x27;t give it a lot of second chances. (My sister&#x27;s former job at Target was to be a buyer, and she thought that if a Target buyer screws up and purchases a bad product, Target should make that right, period.)<p>By contrast, I recently bought what was labeled as an &quot;Epson ink-jet printer cartridge&quot; through a third-party seller on Amazon, and when the product arrived it was labeled &quot;Not an OEM product,&quot; and plainly wasn&#x27;t identical to an actual Epson printer cartridge. I contacted Amazon about the purchase, and an Amazon representative said my money would be refunded and I didn&#x27;t have to return the product. That is the way to use big data to build a better customer experience--Amazon could verify how the product was labeled on its site, and perhaps had another customer complain to verify that I wasn&#x27;t making this up. Amazon consistently treats me like my user experience is more important that Amazon&#x27;s next-quarter bottom line, and that builds immense customer loyalty for me.
评论 #6935166 未加载
评论 #6935396 未加载
评论 #6935859 未加载
swalshover 11 years ago
I worked for Stores Development at Target about 6 years ago. honestly, this really surprises me. After the JCPenny incident, anything security related practically got rubber stamped.
smokinjoeover 11 years ago
Any long-term parking vets here?<p>I didn&#x27;t take a ticket and instead swiped my CC to get into the lot. They repeatedly mentioned to <i>don&#x27;t lose your card</i> since the day I left is tagged to it (I assume).<p>Given the chaos of this, I probably won&#x27;t even get my new card until I&#x27;m back from vacation.<p>Does anyone know if all I need is another card with my name on it or if I can just allow for 30-60 minutes of searching through records to locate my original swipe in?
JimmaDaRustlaover 11 years ago
Another reason for EMV compliance. The track data is stored on the magnetic stripe, which shouldn&#x27;t even be stored on the machine, but it is for some reason.<p>Also, PCI Compliance - personal information should not be stored unencrypted when at rest or when being transferred.
traereganover 11 years ago
&#x2F;me calls credit card company.
评论 #6934585 未加载
评论 #6936305 未加载
Cort3zover 11 years ago
You could say they were a target of the breach.<p>All joking aside, this isn&#x27;t good. Does this mean a lot of other stores are in the danger zone as well? I know a lot of stores use the same software to run their everything.
评论 #6935547 未加载
zimbatmover 11 years ago
If payments could be initiated from a smartphone, the attack surface would be the phone, the bank. Not every shop or website where you enter your credit card details.
carsonreinkeover 11 years ago
I still do not understand why they would have to store the credit card instead of just storing an authorization and transaction number.
评论 #6934579 未加载
评论 #6934780 未加载
评论 #6934559 未加载
almost_startedover 11 years ago
Well, they are sort of asking for it with a name like &quot;Target&quot;, and a giant red bullseye painted on every fricken store!
mpg33over 11 years ago
Another reason why Bitcoin (or something like it) does have legitimate benefits...
评论 #6936095 未加载
评论 #6936039 未加载