5 ms·
This article had a little more info: http://krebsonsecurity.com/2013/12/sources-target-investigating-data-breach/ http://krebsonsecurity.com/2013/12/sources-tar
by chaz 13y ago
This article had a little more info: http://krebsonsecurity.com/2013/12/sources-target-investigating-data-breach/ http://krebsonsecurity.com/2013/12/sources-target-investigat...
The type of data stolen — also known as “track data” —
allows crooks to create counterfeit cards by encoding the
information onto any card with a magnetic stripe.
So it's not just the credit card numbers, but it's the full magstripe that was read and transmitted as-is to some central location where it was lifted. Debit cards and PINs, too, presumably.
- jakewalker 13y agoWhy do you presume that debit card PIN numbers are stored on the card? (They aren't, as far as I know - how else could you change your PIN over the phone or on the card issuer's website?)
- chaz 13y agoSorry, I should have been more clear. PINs have not been confirmed compromised in any reports I've read so far, but it's been mentioned as a possibility. If magstripes were transmitted/stored by Target to perform the authorization, then it's possible that PINs for debit cards were transmitted/stored as well.
- joecurry 13y agoHe's not presuming the PIN is ON the card, but that the transaction was the point of compromise (i.e. you punching in your PIN and the software running a verification of if that PIN is correct).
- jakewalker 13y agoAh - that makes more sense.
- schnable 13y agoI'm not surprised they store something like this, when you return something you can scan your card to verify that you were the original purchaser. But why not store an irreversible hash instead of the actual magstripe?