<p>Target is rapidly losing any sympathy I had for them with this dribble out of information, some of which (particularly concerning PINS) contradicts what they said earlier – and there is still no path for the id theft monitoring they promised back in December.</p>
<p>It was either CNN or the NYT, but somewhere tonight I read that Target requires ID when purchasing wine. Instead of simply verifying the purchaser’s age, the cashier swipes the card through her register. I sense there is a great deal of data compiled.</p>
<p>Some excerpts from tonight’s NYT article.</p>
<p>I would be putting a freeze on my credit, if I didn’t have one already!</p>
<p>Security experts say that clever hackers could potentially piece together customers stolen information for identity theft or for use in a so-called spear phishing attack, in which hackers send a highly tailored emails to victims asking them to click on a link or download an attachment that, once opened, gives hackers a foothold into their computers and employers networks.</p>
<p>After the initial breach, Target said that it had protected customers payment information with encryption and that it had stored the keys to descramble it on separate systems not affected in the breach. But the encryption algorithm Target used to protect that data a standard known as triple DES, or 3DES is vulnerable in some cases to so-called brute force attacks, when hackers use computers for high-speed guessing. In a breach on Adobe last year, hackers were able to bypass 3DES encryption through brute force attacks and exposed tens of millions of Adobe passwords within weeks of the breach.</p>
<p>In Targets case, what this highlights is that the point-of-sale systems customers use to swipe their credit cards are connected to the corporate network like everything else. There is lots of opportunity to compromise individuals through point-of-sale machines and then pivot to the corporate network.</p>
<p>Mr. Ghosh said he suspected that hackers might use the trove of email addresses to send spoofed correspondence from Target, asking users for more information than they would typically be asked to enter, such as a mothers maiden name or a Social Security number, that hackers could use for identity theft, or to take their credentials and use it for cybercrime.</p>
<p>Target also swipes ID for returns without receipt and check writers. It’s a lot of data. I’ve definitely had my ID swiped at Target a bunch of times. But not during the dates in question. Whew!</p>
<p>ucb–I was saying I suspect Target withheld this additional finding not the hackers.</p>
<p>I used a cc not a Target card, and as Arabrab stated, it is irritating that that they have not provided any idea as to signing up for the promised “free credit monitoring” I had this situation occur previously twice with other similar security breaches and the free monitoring was immediately and simply offered.</p>
<p>lindz—they have finally announced that they will offer free monitoring but it doesn’t sound as though they are ready for the slamming volume of requests they will receive. Probably need to ensure the credit monitoring doesn’t get hacked.</p>
<p><a href=“https://corporate.target.com/discover/article/Target-to-offer-free-credit-monitoring-to-all-gues[/url]”>Target Corporate;
<p>“It was either CNN or the NYT, but somewhere tonight I read that Target requires ID when purchasing wine. Instead of simply verifying the purchaser’s age, the cashier swipes the card through her register. I sense there is a great deal of data compiled.”</p>
<p>My local Target justs asks for your date of birth . I rattled mine off one time and my son got on my case “would you recite your SS# in public?” So now I just give them a fake one. ( can I get arrested for that?). Being vain, I shave 5 years off my age. In retrospect, I should be adding 5 so that people think “Dang, she looks good for 60” instead of “I hope I look better than that at 50”. </p>
<p>I didn’t get any email from them, but I’ve never given them my email and given the security breach wouldn’t open one if I got it…</p>
<p>
</p>
<p>I find that less likely than them not discovering this second crack until some time after discovering the first crack. Corporate IT in general does not have a particularly good record with security, so it would not be surprising if many companies, large and small, have been cracked in similar ways, but have not discovered that they are cracked.</p>
<p>My DD confirmed that her credit card was not used at Target during the reported breach period. However, last week she received a letter from her credit card company stating that she would be issued a new card within a few weeks due to the ‘security breach at a large national retailer.’ When she called the CC company to get a clarification, they said that this is only being done for accounts that have potentially been affected by the breach. I agree that they did not report the full scope of the problem to the public in a timely fashion.</p>
<p>She has received no correspondence form Target to date.</p>
<p>dragonmom–I have only shaved a few years off my age but I do use the same fake b-day for any website that demands my b-day. I figure this way I will remember my fake b-day in case I ever need it to log in somewhere.</p>
<p>ucb–it was not a second crack, it was only the first, but there appears to have been a minimization of the scope of this breach, and of what type of data was actually accessed.</p>
<p>CT417–thanks for the link re: the announcement, however the CEO actually announced the free credit monitoring much earlier, in fact I posted it up thread on 12/22. That’s why I find it frustrating that they have yet to provide the actual sign up.</p>
<p>lindz—sorry! I just read the last page or two of the thread. I am not a Target shopper so have been following the story just out of interest.</p>
<p>Would you consider putting a freeze on your credit? It only required sending a notarized letter to the three credit reporting agencies for you and your spouse. CT charged a slight fee but it is free in some states. Identity theft is what I fear more than illegal charges.</p>
<p>
</p>
<p>It appears to be a different crack, since the first crack involves card info being skimmed from the point-of-sale system, while the second crack involves names, addresses, and email addresses (which are not gotten from card information from the point-of-sale system). Possibly the same suspects, but two different cracks.</p>
<p>Cracking is so common probably because the offense side (the crackers) could probably be CS majors in college. In contrast, the defense side (corporate IT) is made up of those who probably majored in IT/MIS/CIS (i.e. business with lightweight computer management courses) in college (and note that defense is harder than offense in general). Who do you think will “win”?</p>
<p>according to this article
[Target</a> estimates breach affected up to 110 million - NBC News.com](<a href=“http://www.nbcnews.com/business/target-says-stolen-info-data-breach-hit-70-million-people-2D11894083]Target”>Target estimates breach affected up to 110 million)</p>
<p>The company said Friday that as part of its ongoing probe it found information for at least 70 million people, apart from the 40 million payment card accounts previously disclosed, was stolen during the data breach. </p>
<p>It said this is NOT a new breach. There may be some overlap between the two groups, Molly Snyder, a Target spokeswoman said, but it’s unclear by how much.</p>
<p>I already have credit monitoring courtesy of the great state of South Carolina because of a data breach in their tax department. I get a letter with sign up information a few months after the incident. </p>
<p>It sounds as though these thieves also have information that could drain your bank account or perpetrate identity theft… I’m not sure how you protect against those scenarios.</p>
<p>They also have information they could use to try to phish information from you. If you get emails regarding these accounts and they refer you to a web site, go that site manually. I have all my financial websites bookmarked so I can go to them manually easily. Do not click on the link in the email. If you are tempted to click on the link in the email, hover over it first. Most email clients will show the actual URL/web address somewhere on your screen when you hover over it. Sometimes it is in the lower left hand corner. </p>
<p>Ditto with people calling you about these accounts. Tell them you will call back and call the number on the back of your card. Don’t give them any information over the phone. If they are calling YOU, they don’t need to verify your account info with the last 4 digits of your SSN. They know who they called. When I’ve had them call to verify whether I’d made charges, they gave me all the information- I didn’t have to give them any info. They said “Did you have a transaction for $450 at Home Depot in Taylor?” or whatever. They read my address to me and asked me if it was correct. I didn’t have to give them information. </p>
<p>Some emails and phone calls can seem very legit.</p>
<p>Security experts are saying that they compromised the scanning machines AND the general info customer database of people who get coupons, emails, etc. One of our cyber crime investigators at work has been getting some information on how this was done and we’re going to have a workshop at work to go over this particular breach. It helps us understand the hackers newest methodologies so we can work on protecting information better. </p>
<p>The way of doing business has changed a lot and I know I’m signed up to get deals sent to my cell via text and I have elected to receive deals from some retailers via email. Consider whether it is worth the risk of having a hacker obtain that information when you choose to do that.</p>
<p>I received phishing emails purportedly from one of credit bureaus the day after Christmas, right after the Target breach was first announced. Have received several more since.</p>
<p>I was on the fence about canceling my credit card, but the phishing convinced me I needed to do so. I also warned my credit union about the phishing attacks, and they in turn sent notices out to it card services dept and added a phishing warning to its Target security breach info webpage.</p>
<p>Saw a blurb in paper today that Neiman Marcus may have been compromised. They said “We were told by our credit card processor in mid December that some unauthorized purchases may have been made with customer cards” That statement would make me think their issue is someone inside using the credit card numbers.</p>
<p>Got email yesterday from Discover (which I used in December in Target) that they are sending me a new card with a new number</p>
<p>Now consider all of the places where you might use your credit card that are not big companies which would make the news if cracked, or whose corporate IT departments* would not even notice that they have been cracked.</p>
<p>*Or the small shopkeeper who is an expert in selling what s/he sells, but has no knowledge of how to secure his/her point-of-sale system, web page order form, or other computers.</p>
<p>^^^^^^ This is so true and so scary.</p>
<p>My Grandparents used to keep their money in a locked freezer out on the porch - the key was in Grandma’s apron pocket.</p>