Support NeoGAF

[Ripclawe]

http://finance.yahoo.com/news/exclusive-target-hackers-stole-encrypted-203852085.html

The hackers who attacked Target Corp (TGT) and compromised up to 40 million credit cards and debit cards also managed to steal encrypted personal identification numbers (PINs), according to a senior payments executive familiar with the situation.

One major U.S. bank fears that the thieves would be able to crack the encryption code and make fraudulent withdrawals from consumer bank accounts, said the executive, who spoke on the condition of anonymity because the data breach is still under investigation.

Target spokeswoman Molly Snyder said "no unencrypted PIN data was accessed" and there was no evidence that PIN data has been "compromised." She confirmed that some "encrypted data" was stolen, but declined to say if that included encrypted PINs.

"We continue to have no reason to believe that PIN data, whether encrypted or unencrypted, was compromised. And we have not been made aware of any such issue in communications with financial institutions to date," Snyder said by email. "We are very early in an ongoing forensic and criminal investigation."

The No. 3 U.S. retailer said last week that hackers stole data from as many as 40 million cards used at Target stores during the first three weeks of the holiday shopping season, making it the second-largest data breach in U.S. retail history.

Target has not said how its systems were compromised, though it described the operation as "sophisticated." The U.S. Secret Service and the Justice Department are investigating. Officials with both agencies have declined comment on the investigations.

The attack could end up costing hundreds of millions of dollars, but it is unclear so far who will bear the expense.

While bank customers are typically not liable for losses because of fraudulent activity on their credit and debit cards, JPMorgan Chase & Co (JPM) and Santander Bank (SAN.MC) said they have lowered limits on how much cash customers can take out of teller machines and spend at stores.

The unprecedented move has led to complaints from consumer advocates about the inconvenience it caused from the late November Thanksgiving holiday into the run-up to Christmas. But sorting out account activity after a fraudulent withdrawal could take a lot more time and be worse for customers.

JPMorgan has said it was able to reduce inconvenience by giving customers new debit cards printed quickly at many of its branches, and by keeping branches open for extended hours. A Santander spokeswoman was not available for comment on Tuesday.

Security experts said it is highly unusual for banks to reduce caps on withdrawals, and the move likely reflects worries that PINs have fallen into criminal hands, even if they are encrypted.

"That's a really extreme measure to take," said Avivah Litan, a Gartner analyst who specializes in cyber security and fraud detection. "They definitely found something in the data that showed there was something happening with cash withdrawals."

BREAKING THE CODE

While the use of encryption codes may prevent amateur hackers from obtaining the digital keys to customer bank deposits, the concern is the coding cannot stop the kind of sophisticated cyber criminal who was able to infiltrate Target for three weeks.

Daniel Clemens, CEO of Packet Ninjas, a cyber security consulting firm, said banks were prudent to lower debit card limits because they will not know for sure if Target's PIN encryption was infallible until the investigation is completed.

As an example of potential vulnerabilities in PIN encryption, Clemens said he once worked for a retailer who hired his firm to hack into its network to find security vulnerabilities. He was able to access the closely guarded digital "key" used to unscramble encrypted PINs, which he said surprised his client, who thought the data was secure.

In other cases, hackers can get PINs by using a tool known as a "RAM scraper," which captures the PINs while they are temporarily stored in memory, Clemens said.

The attack on Target began on November 27, the day before the Thanksgiving holiday and continued until December 15. Banks that issue debit and credit cards learned about the breach on December 18, and Target publicly disclosed the loss of personal account data on December 19.

On December 21, JPMorgan, the largest U.S. bank, alerted 2 million of its debit cardholders that it was lowering the daily limits on ATM withdrawals to $100 and capping store purchases with their cards at $500.

On Monday, the bank partly eased the limits it had imposed on Saturday, setting them at $250 a day for ATM withdrawals and $1,000 a day for purchases. (The usual debit card daily limits are $200 to $500 for cash withdrawals and $500 for purchases, a bank spokeswoman said last week.)

On Monday, Santander - a unit of Spain's Banco Santander (SAN.MC) - followed suit, lowering the daily limits on cash withdrawals and purchases on Santander and Sovereign branded debit and credit cards of customers who used them at Target when the breach occurred. Santander did not disclose the new limits, but said it was monitoring the accounts and issuing new cards to customers who were affected.

The largest breach against a U.S. retailer, uncovered in 2007 at TJX Cos Inc (TJX), led to the theft of data from more than 90 million credit cards over about 18 months.

 

[ScrubJay]

Used to work for Target. Not suprised, at all levels they put forth the bare minimum of effort required to run a store. InfoSec of course wouldn't suprise me they compromised on. Good thing I always pay by cash.

 

[Nosferatu]

Used to work for Target. Not suprised, at all levels they put forth the bare minimum of effort required to run a store. InfoSec of course wouldn't suprise me they compromised on. Good thing I always pay by cash.

I use to work for Target as well, 7 years and the douches canned me because they didn't like me speaking out against *Target policies* and while i feel really bad for all their customers, i cannot be happier this happened to Target, they need a hard reality check that they are not as special as they think they are.

 

[KingBeyondTheWall]

What if Walmart hired the hackers

 

[mollipen]

I never keep more than $200 in the account connected to my debit card at any one time. I have the money in a separate account that I never, ever use the debit card for, and move money into my daily use account as needed.

I know everybody might not be in a situation to do something similar, but I think it's one good step to take in case things like this happen. Even if your bank ends up covering for any money stolen from your account, that money could be tied up for a while until things get sorted out.

Also, seriously, we need a form of payment in 2013 that actually seems like it should exist in 2013. There's just so many ways to compromise debit/credit cards.

 

[Qazaq]

I never keep more than $200 in the account connected to my debit card at any one time. I have the money in a separate account that I never, ever use the debit card for, and move money into my daily use account as needed.

I might have to do this. Good suggestion.

 

[richiek]

I'm so glad I pretty much do grocery shopping at Target and only pay with cash.

 

[The_Inquisitor]

Recently switched from my MasterCard debit for all purchases to an Amex credit card. Looks like it was a wise decision.

 

[Thoraxes]

I never keep more than $200 in the account connected to my debit card at any one time. I have the money in a separate account that I never, ever use the debit card for, and move money into my daily use account as needed.

I know everybody might not be in a situation to do something similar, but I think it's one good step to take in case things like this happen. Even if your bank ends up covering for any money stolen from your account, that money could be tied up for a while until things get sorted out.

Also, seriously, we need a form of payment in 2013 that actually seems like it should exist in 2013. There's just so many ways to compromise debit/credit cards.

DNA. Let's do it.

 

[Lkr]

oh well my card was expiring in a few months anyway

 

[Jailer of Hope]

Used to work for Target. Not suprised, at all levels they put forth the bare minimum of effort required to run a store.

I'm starting to feel that way about them. I just had a particularly bad experience with them earlier today.

 

[.GqueB.]

I'm so glad I pretty much do grocery shopping at Target and only pay with cash.

There's no Trader Joes near you?

 

[CornBurrito]

I use to work for Target as well, 7 years and the douches canned me because they didn't like me speaking out against *Target policies* and while i feel really bad for all their customers, i cannot be happier this happened to Target, they need a hard reality check that they are not as special as they think they are.

It seems to me like this happened less to Target and happened more to millions of people who shop at Target. Seems a bit odd to take delight in that.

 

[Arsenic]

It seems to me like this happened less to Target and happened more to millions of people who shop at Target. Seems a bit odd to take delight in that.

Reputation at Target has been tarnished.

Then again, reputation for ANY retailer has been tarnished for me. A big retailer like this allowing this to happen? Macy's could be next for all I know.

I found it very odd the Secret Service got involved. I know they do work outside of protecting the certain high profile figures, but I can't help but to think maybe one of their own has been compromised as well (ie, Bill Clinton).

 

[CornBurrito]

Reputation at Target has been tarnished.

Oh I know. But at the same time a lot of people could get fucked over by this. Being happy that this happened seems really myopic.

 

[Akyan]

Why was Target storing the PINs anyway? I thought MasterCard and Visa policies meant that wasn't allowed....

 

[Arsenic]

Oh I know. But at the same time a lot of people could get fucked over by this. Being happy that this happened seems really myopic.

Yeah I agree, somewhat lol. I wouldn't celebrate this either, but this is a nice reminder not to rely too much on convenient technology. The consequences can be severe....not as severe as losing your wallet with $500 in cash but that's not the point lol.

Why was Target storing the PINs anyway? I thought MasterCard and Visa policies meant that wasn't allowed....

They probably weren't. The data was probably intercepted live during the transactions. There's a device for this that can be installed on individual registers but with a scale of 40 million customers being compromised, there had to be something more sophisticated at their central servers or something.

 

[Phoenix]

Reputation at Target has been tarnished.

Then again, reputation for ANY retailer has been tarnished for me. A big retailer like this allowing this to happen? Macy's could be next for all I know.

I found it very odd the Secret Service got involved. I know they do work outside of protecting the certain high profile figures, but I can't help but to think maybe one of their own has been compromised as well (ie, Bill Clinton).

They wouldn't be involved for that, in particular, but anytime such a large exploit happens and there is the possibility of foreign criminal involvement - the Secret Service is generally on the case along with the other agencies.

 

[Phoenix]

Why was Target storing the PINs anyway? I thought MasterCard and Visa policies meant that wasn't allowed....

My understanding of where the forensics is heading is suggesting that its not that Target was storing the PINS, its that the hackers had compromised the systems "behind the firewall", infiltrated the point of sale unit itself and was reading the data from the card readers which encrypt the data for transmission to the card processor. That level of exploit in a supposedly PCI environment is incredible. If what the forensics are suggesting pans out - this would be one of the most sophisticated real time hacks of all time.

 

[Stencil]

[...]i cannot be happier this happened to Target[...]

Dude, I donno if this has been said but, fuck you. Sincerely, fuck you. This did not happen to Target, this happened to me. This happened to my mom. This happened to my neighbors. So, go fuck yourself.

 

[Arsenic]

Dude, I donno if this has been said but, fuck you. Sincerely, fuck you. This did not happen to Target, this happened to me. This happened to my mom. This happened to my neighbors. So, go fuck yourself.

I'll try my best to defend him.

What happened may have been inevitable. He's just happy the criminals chose Target as their uh, target.

I mean, I hope that's what he means.

They wouldn't be involved for that, in particular, but anytime such a large exploit happens and there is the possibility of foreign criminal involvement - the Secret Service is generally on the case along with the other agencies.

Thanks for the insight man

 

[TAJ]

My mom called and told me she got hit by this. I would have, but I just happened to have a big wad of cash on me when I went there during that time.

 

[jamesinclair]

Dude, I donno if this has been said but, fuck you. Sincerely, fuck you. This did not happen to Target, this happened to me. This happened to my mom. This happened to my neighbors. So, go fuck yourself.

My tears go out for you, your mom and your neighbors.

You'll have to spend all of ten minutes on the phone with you bank getting a new card.

What a catastrophe.

 

[nateeasy]

Used to work for Target. Not suprised, at all levels they put forth the bare minimum of effort required to run a store. InfoSec of course wouldn't suprise me they compromised on. Good thing I always pay by cash.

Maybe you weren't brand enough?

 

[andthebeatgoeson]

My tears go out for you, your mom and your neighbors.

You'll have to spend all of ten minutes on the phone with you bank getting a new card.

What a catastrophe.

If someone gets his money, it'll be more than 10 minutes. And a theft of this magnitude deserves our scorn. Such a shitty situation.

 

[BigDug13]

So even if I cancelled the debit card and got a new one with a different number, they will still be able to siphon money out of my account if I didn't change the card's PIN?

 

[yogloo]

I'm in here for the puns and I leave extremely dissapointed.

 

[Atolm]

I never keep more than $200 in the account connected to my debit card at any one time. I have the money in a separate account that I never, ever use the debit card for, and move money into my daily use account as needed.

I know everybody might not be in a situation to do something similar, but I think it's one good step to take in case things like this happen. Even if your bank ends up covering for any money stolen from your account, that money could be tied up for a while until things get sorted out.

Also, seriously, we need a form of payment in 2013 that actually seems like it should exist in 2013. There's just so many ways to compromise debit/credit cards.

This is what I do as well. I've been buying at crazy & shady Chinese stores for years and not a single problem, even after the PSN hack I didn't bother to change the card.

 

[UltimateIke]

I found it very odd the Secret Service got involved. I know they do work outside of protecting the certain high profile figures, but I can't help but to think maybe one of their own has been compromised as well (ie, Bill Clinton).

Protection of the country's financial systems is actually the Secret Service's first job and the reason it was created.

 

[Kareha]

You'd think the NSA should already know who did this

 

[wildfire]

I'm in here for the puns and I leave extremely dissapointed.

Good. You don't deserve getting your jollies off over the misfortune of others. Happy fucking holidays.

 

[Data West]

Used to work for Target. Not suprised, at all levels they put forth the bare minimum of effort required to run a store. InfoSec of course wouldn't suprise me they compromised on. Good thing I always pay by cash.

Also used to work there. Terrible experience. And it wasn't even one of those upfront 'the boss doesn't like me' type experiences. It's one of those gossiping hens, won't tell you to your face, make you work positions you're not supposed to work type deals.

 

[grandjedi6]

Protection of the country's financial systems is actually the Secret Service's first job and the reason it was created.

Yeah, the whole protect the president thing came after.

"Hey, we should probably stop letting our Presidents get shot... Who's not doing anything right now? Secret Service? Alright, put them on it for now. I'm sure we won't be lazy and just keep that as the status quo for a century"

 

[slit]

I'm calling my bank and getting a new card tomorrow. I had a lot of Christmas shopping to do and I didn't want to cancel the card during all that. Been keeping tabs on my account though.

 

[djplaeskool]

What if Walmart hired the hackers

Meanwhile, in Bentonville, Arkansas...

 

[usea]

You'd think the NSA should already know who did this

The NSA doesn't investigate crimes. The NSA only cares about military and political leaders' interests. The FBI (and sometimes secret service) investigates crimes.

 

[slit]

You'd think the NSA should already know who did this

They do know, since it was them. The NSA employees love to buy each other argyle socks for Christmas from ripped off cards.

 

[Random Painted HIghway]

Reputation at Target has been tarnished.

Then again, reputation for ANY retailer has been tarnished for me. A big retailer like this allowing this to happen? Macy's could be next for all I know.

I found it very odd the Secret Service got involved. I know they do work outside of protecting the certain high profile figures, but I can't help but to think maybe one of their own has been compromised as well (ie, Bill Clinton).

Secret service does a lot of id theft now. Every federal agency joins in these investigations where reasonable to get credit. Ss is with treasury and their reach is quite far if they choose. And in these days of budget issues, they want to appear busy.

 

[helloresolven]

I found it very odd the Secret Service got involved. I know they do work outside of protecting the certain high profile figures, but I can't help but to think maybe one of their own has been compromised as well (ie, Bill Clinton).

Try counterfeiting a US dollar bill... guess which government agency shows up?

There's a reason the Secret Service was once controlled by the Dept. of Treasury.

 

[Vox-Pop]

Dude, I donno if this has been said but, fuck you. Sincerely, fuck you. This did not happen to Target, this happened to me. This happened to my mom. This happened to my neighbors. So, go fuck yourself.

So your money was stolen already? Or are just being like a bunch of people and overreacting?

 

[slit]

Reputation at Target has been tarnished.

Then again, reputation for ANY retailer has been tarnished for me. A big retailer like this allowing this to happen? Macy's could be next for all I know.

I found it very odd the Secret Service got involved. I know they do work outside of protecting the certain high profile figures, but I can't help but to think maybe one of their own has been compromised as well (ie, Bill Clinton).

Of course Macy's could be next, any retailer could be next. I work in IT security, there is always risk. The size of the retailer has nothing to do with it. Your info can be stolen ANY time you use your card.

 

[Rootbeer]

changed my RED card pin and ordered a new RED card on top of that. i only use my RED card at target, nothing else so I don't feel very impacted. However I hope high-profile, widespread attacks like this will lead to some reform in how we handle transactions, we need something more secure, especially in the usa.

 

[richiek]

There's no Trader Joes near you?

Yeah I go to Trader Joes too. I'm just saying I rarely buy big budget items at Target.

 

[AyaisMUsikWhore]

Wow. This is absolutely crazy. I received mail from my credit union telling me about this whole hacking situation and they are sending me a new card ASAP. There also watching my account to make sure that I'm not compromised, though they informed me I haven't.

Good thing when I last went to target last week, the cashier asked me if I wanted to open a card and I said no.

I hope some people aren't severely compromised. If so, Target is going to owe a lot of money.

Edit : Now that I think of it, I believe that now NFC payments might become huge within the next year. Some type of cloud based payment system should I say.

 

[gcubed]

Using debit cards with a pin at a pos machine is just a bad idea in general. Even if you just use your debit card like a credit card at least you aren't giving out your pin everywhere. There needs to be a better system if we are going to continue using something tied to "real" money.

 

[Nosferatu]

Dude, I donno if this has been said but, fuck you. Sincerely, fuck you. This did not happen to Target, this happened to me. This happened to my mom. This happened to my neighbors. So, go fuck yourself.

It seems to me like this happened less to Target and happened more to millions of people who shop at Target. Seems a bit odd to take delight in that.

Seriously guys, did you not read my post? I FEEL absolutely terrible for you and you and everyone else that went through this, trust me i do. I just hate Target with a passion because they treat their employees like utter dirt while the corporation itself thinks that they treat them like kings and queens which is not the case. I just feel like they need to be knocked down a few pegs is all.

 

[perfectchaos007]

My tears go out for you, your mom and your neighbors.

You'll have to spend all of ten minutes on the phone with you bank getting a new card.

What a catastrophe.

Well for people like me who only has one debit card and no credit card, I'll have to withdraw some cash to get me through while I wait the 8-15 business days to get my new card. Thats a major inconvenience. First world problems I know....but still

 

[.GqueB.]

Yeah I go to Trader Joes too. I'm just saying I rarely buy big budget items at Target.

Damn right you go to Trader joes.

 

[GoldenEye 007]

Using debit cards with a pin at a pos machine is just a bad idea in general. Even if you just use your debit card like a credit card at least you aren't giving out your pin everywhere. There needs to be a better system if we are going to continue using something tied to "real" money.

Isn't a card and PIN the system Europeans keep saying the US should make standard even for credit cards?

Is there a big difference between using a mag strip vs. a chip to retrieve information?

 

[Vilix]

Reputation at Target has been tarnished.

Then again, reputation for ANY retailer has been tarnished for me. A big retailer like this allowing this to happen? Macy's could be next for all I know.

I found it very odd the Secret Service got involved. I know they do work outside of protecting the certain high profile figures, but I can't help but to think maybe one of their own has been compromised as well (ie, Bill Clinton).

One of the Secret Service main mission is investigation of financial crimes.