4 ms·
I still do not understand why they would have to store the credit card instead of just storing an authorization and transaction number.
by carsonreinke 13y ago
I still do not understand why they would have to store the credit card instead of just storing an authorization and transaction number.
- maxerickson 13y agoIt seems likely that their card authorization system was compromised.
- chaz 13y agoThis article had a little more info: http://krebsonsecurity.com/2013/12/sources-target-investigating-data-breach/ http://krebsonsecurity.com/2013/12/sources-target-investigat... The type of data stolen — also known as “track data” — allows crooks to create counterfeit cards by encoding the information onto any card with a magnetic stripe. So it's not just the credit card numbers, but it's the full magstripe that was read and transmitted as-is to some central location where it was lifted. Debit cards and PINs, too, presumably.
- jakewalker 13y agoWhy do you presume that debit card PIN numbers are stored on the card? (They aren't, as far as I know - how else could you change your PIN over the phone or on the card issuer's website?)
- chaz 13y agoSorry, I should have been more clear. PINs have not been confirmed compromised in any reports I've read so far, but it's been mentioned as a possibility. If magstripes were transmitted/stored by Target to perform the authorization, then it's possible that PINs for debit cards were transmitted/stored as well.
- joecurry 13y agoHe's not presuming the PIN is ON the card, but that the transaction was the point of compromise (i.e. you punching in your PIN and the software running a verification of if that PIN is correct).
- jakewalker 13y agoAh - that makes more sense.
- schnable 13y agoI'm not surprised they store something like this, when you return something you can scan your card to verify that you were the original purchaser. But why not store an irreversible hash instead of the actual magstripe?
- daigoba66 13y agoI got the impression that the hack was more of an intricate skimmer that exploited the POS system's network - basically intercepting credit card track data and PIN numbers between the POS terminals and the processor.