4 ms·

The reports I've seen say 40m sets of card details for the full duration of the hack, which was about two and half weeks, not a single day. And I doubt Target

The reports I've seen say 40m sets of card details for the full duration of the hack, which was about two and half weeks, not a single day. And I doubt Target was storing the data, as they don't have a legitimate business need. Businesses that do have such a need, such as hotels and car rental companies, are allowed to keep the data, but only subject to stringent security. It seems likely that the hackers broke into Target's network and found a way to install malware on the POS terminals, designed to tee the credit card info off to the hackers in real time (or perhaps log it to disk, where the hackers would come by and fetch it).

pdkl95 13y ago
>I doubt Target was storing the data This is a company that loves to try and predict customer behaviours by using massive data-mining techniques. I would be surprised if they didn't store any and all data they get their hands on, especially if it could be used as an additional table key. For background, I recommend this article, which is one of the most interesting works I've seen in the last ~decade: http://www.nytimes.com/2012/02/19/magazine/shopping-habits.html?_r=1&pagewanted=all http://www.nytimes.com/2012/02/19/magazine/shopping-habits.h...
- res0nat0r 13y ago
  Storing customer purchase history via loyalty card etc (ala like what WalMart does and talked about in the doc about it that aired on CNBC a while back) to improved directed marketing is a much different than storing credit card data.
zaroth 13y ago
They almost certainly store the card number with reversible encryption, because you can make a return just with the card you bought the item with (they lookup the receipt from the card number + item SKU). With a receipt and WITHOUT the card, they can also refund directly back to the card it was bought with. Both features are possible without actually storing the card number; one-way hashes to do the receipt lookup, and tokens to do the refund, but how likely is that? I think in Target's case it will turn out the hacker was sniffing network traffic on the internal network, and just pulling every transaction right off the wire.
- deleted 13y ago
  [deleted]
- cynwoody 13y ago
  That might depend on a payment processor service. E.g., when a charge is made, the payment processor returns a unique ID for the transaction. Then, if the merchant decides to give a refund, they put through a transaction that references the sale by its ID, and the payment processor then credits the appropriate piece of plastic with the desired amount. Nothing for a hacker to steal, unless they compromise the payment processor. >Both features are possible without actually storing the card number; one-way hashes to do the receipt lookup, and tokens to do the refund, but how likely is that? There is a company, Shift4† ($-sign on a US keyboard, get it?), who provide credit card processing service to smaller merchants. Shift4 itself is not a payment processor. Rather, it provides an intermediate layer standing between the merchant and the payment processor(s). A prominent feature of its service offering is tokenization: the ability to refer indirectly and opaquely to specific transactions and card accounts. It removes the need for the merchant to store card details. Shift4's tokens give the merchant a way to refer to past transactions and card accounts without having to store card details. †http://shift4.com/ http://shift4.com/

pdkl95 13y ago

>I doubt Target was storing the data This is a company that loves to try and predict customer behaviours by using massive data-mining techniques. I would be surprised if they didn't store any and all data they get their hands on, especially if it could be used as an additional table key. For background, I recommend this article, which is one of the most interesting works I've seen in the last ~decade: http://www.nytimes.com/2012/02/19/magazine/shopping-habits.html?_r=1&pagewanted=all http://www.nytimes.com/2012/02/19/magazine/shopping-habits.h...

res0nat0r 13y ago
Storing customer purchase history via loyalty card etc (ala like what WalMart does and talked about in the doc about it that aired on CNBC a while back) to improved directed marketing is a much different than storing credit card data.

zaroth 13y ago

They almost certainly store the card number with reversible encryption, because you can make a return just with the card you bought the item with (they lookup the receipt from the card number + item SKU). With a receipt and WITHOUT the card, they can also refund directly back to the card it was bought with. Both features are possible without actually storing the card number; one-way hashes to do the receipt lookup, and tokens to do the refund, but how likely is that? I think in Target's case it will turn out the hacker was sniffing network traffic on the internal network, and just pulling every transaction right off the wire.

deleted 13y ago
[deleted]
cynwoody 13y ago
That might depend on a payment processor service. E.g., when a charge is made, the payment processor returns a unique ID for the transaction. Then, if the merchant decides to give a refund, they put through a transaction that references the sale by its ID, and the payment processor then credits the appropriate piece of plastic with the desired amount. Nothing for a hacker to steal, unless they compromise the payment processor. >Both features are possible without actually storing the card number; one-way hashes to do the receipt lookup, and tokens to do the refund, but how likely is that? There is a company, Shift4† ($-sign on a US keyboard, get it?), who provide credit card processing service to smaller merchants. Shift4 itself is not a payment processor. Rather, it provides an intermediate layer standing between the merchant and the payment processor(s). A prominent feature of its service offering is tokenization: the ability to refer indirectly and opaquely to specific transactions and card accounts. It removes the need for the merchant to store card details. Shift4's tokens give the merchant a way to refer to past transactions and card accounts without having to store card details. †http://shift4.com/ http://shift4.com/