Robert Siciliano discusses Target's 2013 data breach that exposed 40 million customers' credit and debit card information between late November and mid-December. He explains how organized crime groups carried out the attack and advises affected shoppers to check statements, contact their banks, and replace their cards.
Chapters
One of the largest hacking attacks on a retail chain this year. If you shopped at a Target store since Thanksgiving, you might be a victim. 40 million Target customers' credit and debit card information was stolen. The Secret Service is now investigating. Target executives say the hackers broke into their payment system. John Tarrant has more. John?
You know, John, that's absolutely right, and the bottom line here is if you shopped at Target between November 27th and December 15th, about 2 and a half weeks, then your credit and debit card information may well now be in the hands of cybercriminals tonight. Now, it's very important to make it clear, this does not affect online shoppers. No, only those people who flashed cards in Target's, what they call, brick-and-mortar stores right around the country and possibly in Canada as well. Now, if that was you, Target says then check your statement and look for charges that you don't recognize. Some of them could be big, some of them could be quite small. Also, call your credit card company and your bank to help ensure that you don't wind up actually paying for fraudulent charges. And also replace your card and your PIN number as quickly as you can. That is most important. Now, once again, the key dates are November 27th through December 15th. If you swiped a debit or credit card at a terminal in a Target store during this time, then your information may well have been compromised. Now, to find out how this kind of mass fraud is done and who might be behind it and where in the world they might be, we turn to an online security expert who has devoted his entire life to trying to stop this kind of cybercrime. Take a look.
The thing about criminal hacking like this is it's not magic. There is science behind this.
Robert Siciliano is an online security expert.
For the past 10 years, they've been compromising one database after another, and so now they have their process well-honed. And this time of the year, holidays, uh, this is the best time for them to strike.
Siciliano says don't believe the notion that hackers are computer geeks who live in their mom's basement. This is organized crime on a grand scale, designed to steal the numbers of as many cards as possible.
When you have a data breach that affects 40 million people, this is the absolute most professional organized criminal syndicate you can think of. These are people that their entire livelihood is structured around finding the vulnerabilities in these networks, planting viruses, and ultimately getting paid.
Robert Siciliano says the syndicates are organized web mobs, and they could be functioning here at home in the US or overseas, and he says data breaches like Target's are not rare.
This is probably one of the top 5 as far as credit card breaches go, but we've seen, you know, 100 million, 130 million credit card number breaches happen in the past, and this will not be the last one.
He also says online security will never be 100%.
There's always going to be some type of vulnerability, whether it's in the technology or with the human element, meaning that somebody on the inside of the organization at Target, for example, could have done something wrong, uh, clicked a link, provided credentials via phishing email. So there's a number of ways that we can get hooked by the bad guy.
Target's advising customers to check their statements carefully for signs of unauthorized activity or risk paying for a hacker's Christmas. In a written statement, the CEO says Target's first priority is preserving the trust of our guests, and we've moved swiftly to address this issue so guests can shop 'with confidence. We regret any inconvenience or concern this incident may have caused you.' Target says it's brought in an outside firm to help prevent such data breaches from happening again, but these shoppers at a store in New Jersey were less than happy that so many cards had been hacked.
It's a trust issue. I mean, people trust Target when they go in to make a purchase.
It definitely worries me. That's why we paid cash, just in case. Siciliano says while customers may pay a little if they overlook an unauthorized item on their statement, Target will pay millions in updating its security.
Hacking like this is not a victimless crime. People, uh, financially, uh, either the consumers, the retailers, and then the banks and the credit card companies, in the end, and even insurance companies, do pay.
As the man said, there is no victimless crime. And we want to make it clear, this is debit cards, credit cards, even those Target store cards, which they promote very heavily as a very key part of their business as well. TJ Maxx, by the way, was hacked in the mid-2000s. 46 million of their cards were potentially compromised. And Sony, also 100 1.5 million PlayStation customers were compromised. So bad was that that the UK government fined Sony because they reckon, John, that Sony could actually have done something about that.
So obviously this hurts for customers, but it's got to hurt Target as well at this time of the year.
It hurts the customer if they don't look at their credit card statement. It's very important to do that. If you see a fraudulent charge on there, the bank will look after you. But Target's in a bad shape really in one way or another because first of all, they've got this issue whereby now it's Christmas time, December, November, that's about 20% of all their retail income for the year. So if customers are now going to not go to Target because of what's happened, then that's really not very good news. Plus, they have potentially hundreds of millions of dollars to put this right, which they have to do.
Right.
And then on top of that, they are a discount store. They don't have very big margins. It's difficult to make the money that they want to make over and above what they're already making anyway. And so unfortunately, they've had a rough ride with Wall Street during the recession. It's been an uneven performance by Target. Last thing the CEO will want is something like this.
