Hackers stole personal information with details of up to 70 million people – a third of American adults – including phone numbers, email and home addresses, the US retail chain Target admitted on Friday.
The management said that the extent of a 19-day pre-Christmas breakin to its computer systems was far greater than it had thought when in late December it estimated the number of credit and debit cards affected at 40m. It hadn’t previously said how many people were affected.
Analysts reckon it will affect more people than the card-skimming operation at TJX Cos Inc in 2007, which was reckoned to affect 90m cards over an 18-month period. “I think they still have no idea how big this is,” David Kennedy, who runs the consulting firm TrustedSec told Reuters. “This is going to end up being much larger than 70 million and end up being the largest retail breach in history.”
The chain previously disclosed to customers that names, credit and debit card numbers, card expiration dates, PINs and the embedded code on the magnetic strip on the back of cards had been stolen. It has assured customers that they won’t be liable for any fraudulent charges that result from the breach.
The PIN code would have been encrypted, but it’s unclear whether other information was stored in a human-readable format.
After the initial announcement of the breach, some banks imposed daily spending limits on customers with affected cards – an unwelcome imposition ahead of the holiday shopping rush. Transactions at Target were down by 3% to 4% on the last weekend before Christmas, while other US retailers reported strong results.
The Minneapolis-based company also forecast a 2.5% decline in fourth-quarter same-store sales. It had previously forecast flat sales. Target also expects its full-year earnings per share to include charges related to the data breach, but said it could not provide an estimate of the costs. Its stock slipped in early morning trading on Friday.
The Target breach followed a huge electronic breakin at Adobe Systems in November 2013, when 152 million user names and passwords were stolen. Although the passwords were encrypted, security experts said that certain flaws in the system used to scramble them could give hackers a way to figure out the original.
The hackers who perpetrated the Target theft seem to have stolen the data during a 19-day period beginning on 27 November. It was brought to public notice by the security researcher Brian Krebs, who reported on 18 December that he had heard of a breach – and later discovered that the details of cards stolen during the attack were flooding into underground criminal markets online, where they were changing hands for between $20 and $100 per card – far above the normal price of stolen card details.
The attack seems to have been timed for the US’s “Black Friday” – the day after Thanksgiving when millions of people go shopping for bargains – which in 2013 fell on 29 November. It then continued through two of the busiest shopping weeks of the year.
Target has previously been the object of such hacking, and paid a $9.75m settlement in 2009 for a 2005 breach.
But the extent of the 2013 breach suggests that the hackers behind it were able to access its central retail systems or its interfaces with banks and credit card companies.
The company told customers Friday that its ongoing investigation of the breach has shown that more personal information had been stolen than it was aware of before and more customers were affected.
“I know that it is frustrating for our guests to learn that this information was taken and we are truly sorry they are having to endure this,” the chairman, president and CEO Gregg Steinhafel said in a statement.
Target said it will try to contact customers for whom it has email addresses to provide tips on how to safeguard against consumer scams. The company said it won’t ask customers for any personal information during its email communications.
It is also offering a year of free credit monitoring and identity theft protection to customers that shopped at its stores. Individuals will have three months to enroll in the program. Target said it will provide more details on that next week.
The retailer said Friday that the personal information stolen is not a new breach, but was discovered during its ongoing investigation.
[“Stock Photo: Hacker Stealing Data From A Computer” on Shutterstock]