Cards Stolen in Target Breach Flood Underground Markets

[enzo1]

Cards Stolen in Target Breach Flood Underground Markets — Krebs on Security

[Embraer]

"we allowed your information to be compromised. sorry about that. here's a 10% off coupon for your next purchase...."

[Don Ro]

"...on Dec. 21 and 22."
.
So, rush right in there and BUY!

[stomachmonkey]

Our new cards showed up today.

Wifey is in the kitchen activating as I type this.

We were not taking any chances.

[Nickshu]

Wow, I just went on Target.com. There is no mention of the breach on the front page. Should be a HUGE banner at the top of the page. Goes to show you how much they care about their customers vs. profits at the holiday season.

For a company that already has a very bad track record for refusing to support local charities, local schools, etc this sure doesn't help them.

[imcarthur]

The process of selling cards in that link is pretty interesting. Brokers buy & sell blocks on forums & they even can sell you local lots of cards so the end user will be local but the info might have bounced through a Russian mobster's hands on the way.

VISA frauded my business card briefly yesterday due to strange purchases but they were all legit & the card was turned on again.

Ian

[jwgn777]

Originally Posted by Nickshu

Wow, I just went on Target.com. There is no mention of the breach on the front page. Should be a HUGE banner at the top of the page. Goes to show you how much they care about their customers vs. profits at the holiday season.

For a company that already has a very bad track record for refusing to support local charities, local schools, etc this sure doesn't help them.

I read the other day that personal info for on line sale were not affected. But nothing is safe in todays web world. or outside establishments.

[911SauCy]

Is this only impacting "Target Cards" or anyone who swiped a card there?

My wife and I are always getting something at Target...

[spuggy]

Originally Posted by 911SauCy

Is this only impacting "Target Cards" or anyone who swiped a card there?

My wife and I are always getting something at Target...

Any card used at any branch of Target, in a 3 week window They're saying the POS terminals - all of them, in every store - were compromised to skim card details.

This seems a little strange/unlikely - but I haven't bought anything at Target in over 4 years, so I don't much care

[mreid]

Any card used at Target during the period. We never shop at Target, but a couple of weeks ago the wife asked me to pick up some silver polish and cloths. Guess where I just happened to stop?!

[manbridge 74]

Bad as this sounds, ransomware is even worse.

Coin of the realm, I say......

[jyl]

Anyone know what penalties and liability Target will face over this?

My impression is that companies don't pay a very heavy price for failing to secure their customers' data, whether credit cards or passwords.

There have been many incidents where millions of peoples' credit cards and account/passwords have been stolen, frequently due to poor security practices by companies who had those peoples' information in their databases. I don't recall many reports of the companies paying heavy fines or their management suffering serious consequences.

Target's card theft isn't expected to hurt the company much. It is not quite, but almost, business as usual.

Here is an article describing a similar theft of 100 million credit card numbers from TJ Maxx. The company eventually spent $250MM on lawsuits, fines, and improvements to its technology. Some of that probably needed to be spent anyway (IT investment), and anyway it is a small sum vs TJX's $20 billion/year in sales. The company's stock didn't get hurt, investors didn't care at all, none of the C-level executives suffered any consequences.

Target's Credit Card Breach Is Bad, But Won't Hurt Business Much

40 million account passwords were lost at Adobe, 6 million at LinkedIn, there are dozens more like this, and a new one every month or three.

Do the companies that obtain and store our personal information have enough incentive to harden their security?

[ossiblue]

Originally Posted by jyl

...(snip)...Do the companies that obtain and store our personal information have enough incentive to harden their security?

^^This is it in a nutshell.^^

It is still "cost effective" for these companies and banks to cover the losses for their customers, issue new cards, and pay settlements on suits. These costs are then passed on to the customers in the form of higher prices, new or higher fees, and cuts in services under the guise of the ever popular, cost of doing business.

Money, of course, is what drives these companies and money (or loss of it) is the only real incentive to get them to take personal security more seriously. We all know that any secure system can be breached--it's an on-going battle that ratchets up the level of security and the sophistication of the breaches whenever it is fought. The penalties should be aimed at those companies that fail to keep pace with the escalating need for more complex and secure systems.

Yes, meaningful monetary penalties may work, but loss of public trust and its patronage is more direct and painful. As long as the general public can live with their loss of personal information being bought off by financial loss coverage and new card or account issuance, there will be no great incentive for companies to improve.

[mreid]

How many on here use the same password for multiple secure sites? Same for your gmail account as your online banking? You don't have to answer, but research shows many baby boomers do. These are the same people with the highest incomes. The same people using more and more handhelds and using Facebook and LinkedIn in increasing numbers. Is it just an inconvenience that your LinkedIn or Facebook password is stolen? How about that phishing email you receive later that looks legit and you feel better when it reminds you not to enter your password for security purposes, but they will need your bank account number? Couldn't be harmful, it's on all your checks right?

My point is that nothing is really safe and you/we can't expect business to protect us passed a certain point. Europe has had chip and pin in credit cards for almost ten years, why not us? In the UK, your credit card never leaves your sight. Why not here? Our head of security copied my credit card onto a hotel key in about 20 seconds as a demo using a handheld scanner. I later used it to get gas. Protect yourself, take advantage of credit monitoring and get new cards if you were possibly exposed. Take no chances! Be personally accountable!

[ossiblue]

Originally Posted by mreid

How many on here use the same password for multiple secure sites? Same for your gmail account as your online banking? You don't have to answer, but research shows many baby boomers do. These are the same people with the highest incomes. The same people using more and more handhelds and using Facebook and LinkedIn in increasing numbers. Is it just an inconvenience that your LinkedIn or Facebook password is stolen? How about that phishing email you receive later that looks legit and you feel better when it reminds you not to enter your password for security purposes, but they will need your bank account number? Couldn't be harmful, it's on all your checks right?

My point is that nothing is really safe and you/we can't expect business to protect us passed a certain point. Europe has had chip and pin in credit cards for almost ten years, why not us? In the UK, your credit card never leaves your sight. Why not here? Our head of security copied my credit card onto a hotel key in about 20 seconds as a demo using a handheld scanner. I later used it to get gas. Protect yourself, take advantage of credit monitoring and get new cards if you were possibly exposed. Take no chances! Be personally accountable!

Mreid makes some good points, we can make some personal decisions that help protect out information but once it leaves our control, to make a purchase for example, we are at the mercy of the systems that are in place where these large breaches are taking place.

Yes, Europe and much of Asia use smart cards with encryption chips that make scanning and subsequent individual thefts much more difficult. The U.S. is the only large country that still uses magnetic stripes and that is why the thieves target (no pun intended) the U.S. in these types of thefts. Why is it so? Because of the expense of converting the entire system to encryption technology. The entire infrastructure of the U.S. credit/debit/atm card system is based around this magnetic strip. Europe is way ahead. We have not taken more than a baby step in the chip-embedded technology. Think of it as changing over from gasoline as a fuel to fuel cells. Not only is our distribution system based around gasoline (refining, trucking, pipelines, stations and pumps), but the internal combustion engine and its ancillary support (auto repair shops, muffler shops, etc.)are as well. Changing to another fuel that require new infrastructure is very disruptive and is met with the inertia of the existing system.

Once your information is in the system, regardless if the cards chipped or not, the controllers of that system--the companies and the servers they employ--are responsible. The Target incident could very well have been a hack into their corporate servers. This is where the incentives should be aimed to keep these things secure. As mreid said, it is up to us to protect our information as best we can, and we must always assume that it may still be compromised by someone or some company further down the line.

[mikester]

The over-arching regulating body for credit card information security is the card industry itself - it is referred to as PCI Compliance or PCI Security Standards.

https://www.pcisecuritystandards.org/

It is a standards body lead by the industry stake holders like AMEX, Visa, MC, including some of the companies that provide security technologies that are depended on for this privacy and security.

I've worked quite a lot in this industry and have consulted for a number of companies in their efforts to maintain and become compliant. Unfortunately the challenges are not 'static' and they evolve ahead of the security technology at times. With that happens to companies who are doing a good job of trying to stay ahead of the curve it's a bummer but when it happens to a company that was not doing a good job or even the bare minimum to maintain security then they were simply asking for it. It isn't when are you going to get hacked it's where have you already been hacked if you're a large company with credit data stored.

Still, the scope of this sounds very much like an inside job to me and all the PCI compliance in the world isn't going to stop an inside job if the insider was on the security staff or had administrative rights.

PCI compliance is actually a pretty good set of guidelines - compared to HIPAA which is really about recommendations and not requirements as I understand it. I'm starting to consult on HIPAA as well and finding it far less good.

HIPAA is the law and it is lame.

PCI is the industry and it is not lame. You want a simple law probalby that says the data must be 'secure and private or else your organization is liable for the fraud.' Outside of that, like what HIPAA tries to do - the law should not outline the way it is done outside of saying using 'industry best practices designed to been the evolutionary curves of security breaches.'

Let a judge decide if they did their due diligence and if they did they did and if they didn't they are liable for all the consequences of not being diligent. In my opinion at least...

[74-911]

Daughter shopped at Target several times during that time frame. She got a call last night from credit card company wanting to know if she was purchasing gift cards at Walgrens?

[74-911]

Originally Posted by mikester

Still, the scope of this sounds very much like an inside job to me and all the PCI compliance in the world isn't going to stop an inside job if the insider was on the security staff or had administrative rights.

That is the really worrisome part. Very difficult to stop that...

[ossiblue]

Originally Posted by mikester

...(snip)...
Still, the scope of this sounds very much like an inside job to me and all the PCI compliance in the world isn't going to stop an inside job if the insider was on the security staff or had administrative rights.

You want a simple law probalby that says the data must be 'secure and private or else your organization is liable for the fraud.' Outside of that, like what HIPAA tries to do - the law should not outline the way it is done outside of saying using 'industry best practices designed to been the evolutionary curves of security breaches.'

Let a judge decide if they did their due diligence and if they did they did and if they didn't they are liable for all the consequences of not being diligent. In my opinion at least...

Originally Posted by 74-911

That is the really worrisome part. Very difficult to stop that...

Agree completely. However, we are talking about two different but related issues. One is the security of stored data by companies, the other is the ease of applying that data to individual cards. The ease in which cards can be counterfeited or compromised is the driving force behind attacks on data storage. The problem remains the archaic credit card system the U.S. employs. As long as thieves can easily commandeer a card because of the magnetic strip, there will be the incentive to hack into the systems for the information. Currently, the U.S. is the number one source for counterfeit/commandeered credit cards and that's why the thieves work to breach the system. If the Target breach was an inside job or not, the information would be useless (or significantly so) if the cards themselves could not be reprogrammed or pirated due to smart card technology and the thieves would be left with 40 million sets of useless data. More than likely, they wouldn't have attempted it at all because they would not benefit.

[mikester]

The identity information is useful as well since they can use that to fraudulently apply for new credit lines.