KrebsOnSecurity broke the story that Target Brands, Inc. is investigating possible credit and debit card record theft that may have occurred between Black Friday until December 6. Target has now responded that the thefts occurred between Nov. 27 to Dec. 15, 2013. Information read from swiping the cards at the register may have been intercepted.
Two anonymous sources confirmed the story but Target did not respond for requests for comment. An American Express representative told Reuters they were aware of the events and were putting controls in place.
“The breach window is definitely expanding,” said one anti-fraud analyst at a top ten U.S. bank card issuer who asked to remain anonymous. “We can’t say for sure that all stores were impacted, but we do see customers all over the U.S. that were victimized.”
Comments on the KrebsOnSecurity site suggest anecdotal evidence that the credit card information was duplicated on fraudulent cards.
Update: Target confirms 40 million accounts affected by theft (Dignan, 2013; Target, 2013).
According to the company, 40 million credit and debit cards were breached between Nov. 27 and Dec. 15. Target said it alerted law enforcement and financial institutions immediately. The company added that it has “identified and resolved the issue.”
References
Dignan, L. (2013, December 19). Target confirms breach: 40 million accounts affected. ZDnet. Retrieved December 19, 2013 from http://www.zdnet.com/target-confirms-breach-40-million-accounts-affected-7000024499/
Finkle, J. (2013, December 18). Target stores’ customers hit by major credit card attack. Reuters: Retrieved December 18, 2013, from http://in.reuters.com/article/2013/12/19/us-target-breach-idINBRE9BH1GX20131219
Krebs on Security. Retrieved December 18, 2013, from http://krebsonsecurity.com/2013/12/sources-target-investigating-data-breach/
Target (2013, December 19). Important Notice: unauthorized access to payment card data in U.S. stores. Target. Retrieved December 19, 2013 from https://corporate.target.com/discover/article/Important-Notice-Unauthorized-access-to-payment-ca