Major Data Breach at Target and how to protect yourself @McAfeeConsumer

Welcome to the Fox 25 News at 5, where every day at 5 we do dig deeper into the big stories of the day. Today, a massive data breach that may impact as many as 40 million Target shoppers and their credit card accounts.

What the retail chain is saying about this and what you can do to protect yourself. This is the big story right now on the Fox 25 News at 5.

I wasn't too shocked about being violated. I was more worried about putting a stop to it before it got worse. You know, I know what the credit card companies are the have it taken care of. It's just a matter of time, and unfortunately our bank accounts aren't that big that we can handle a buffer like this. So it, it hurt.

That right there is Dave Chalant of Winchester, just one of millions of people scrambling after that breach at Target stores. He claims that his wife shopped at the Target in Woburn and then found out that someone charged their credit card for hundreds of dollars in Pennsylvania. And that story again is not just one, it is many upon many. So many people are impacted by this. Hi everybody, Maria Stefanos.

And I'm Mark Ackerblom. Target says they have fixed the problem, but store reps are urging customers to check their statements for any unauthorized charges. Customers who swipe their cards at stores in the U.S. between November 27th and December 15th, they are the ones who are at risk. Customers who see suspicious activity in their accounts are being asked to call the store at 866-852-8680. Stolen information was from both Target store brand cards and major credit cards such as Visa and MasterCard. And we're told the breach did not impact any online purchases, only purchases that were made in stores. Attorney General Martha Coakley says she's working with other attorneys general on this breach.

We're going to be aggressive about, um, tracking this down, making sure consumers are protected, and looking at what and under what circumstances this happened.

Interesting too, Target is not saying how the breach happened.

So let's talk to Robert Siciliano, McAfee online security expert, live at our Beacon Hill studio. I mean, we always like to see you, Robert, because you're a great expert, but I'll tell you, when we see you, we know that there's a problem out there, and this is a big one.

Yeah, this is a big one. $40 million is a significant, a significant part of the population who is going into the holiday seasons wondering if in fact their credit card numbers are being used by bad guys as they sit down for Christmas dinner.

Yeah, myself included. I went to the Target on Black Friday and Braintree, and I'm just thinking, are you kidding me? I don't have time to even check right now. And I know I'm not alone. Target not saying how this whole thing happened. What do you think happened?

So in order for essentially all of their stores and all of their point of sales to be compromised, a server or a series of servers somewhere that is responsible for processing all of their credit card information had to be compromised. So somebody got access basically to a mainframe that sees every single transaction, and basically, you know, they were inside that system for a couple of weeks accessing all that data.

You know, everyone remembers the infamous TJX breach, and that affected some 40 million people as well. What's the difference between that and this, perhaps?

Not much. Uh, the root of the TGX breach, from what I remember, was a wireless connection to the internet had been compromised at a Marshall's store. I think it was in St. Paul. So it was basic hacking, and then they installed a virus on a device, a PC, which gave them access to a manager's credentials to get into the main server. So how they got access to the main server with Target, we're not quite sure, but they're definitely got into the mainframe, and from there, you know, they saw all of those transactions transpiring over 2 weeks.

Robert, how did that—

why—

how could this go on so long without anybody noticing?

Yeah, that is a question that I'm sure many are asking at this point. You know, when they're conducting that much business in such a short period of time, it may be different. I'm not on the inside, so I don't know, but it may be difficult to see, uh, these transactions occurring. My guess is they have such a large system that, that the actual breach may have been very small in nature in regards to the scope of the amount of transactions that are occurring. And so when they do daily or weekly scans, that's probably when they found it.

You know, it's amazing to think that this could be domestic. It could be international. I mean, how do you track something like this and finally hunt these people down?

Chances are it's a combination of domestic and international.

Mm-hmm.

The majority of these crimes that have been perpetrated over the past decade are organized web mobs that work both here in the U.S. and overseas. They're basically, you know, criminal hackers, technologists that understand how all this work. They work in tandem. They coordinate and execute these attacks on a massive scale. But there could be, you know, as few as a few guys or women, as a matter of fact, or dozens of people involved in this particular hack, but those involved in, you know, protecting us— Secret Service, FBI, and so forth— they'll find some breadcrumbs that will give them some insight as to where these attacks originated from.

Robert, can I go back to how this whole thing happened? There was some talk about keypads. So is it if we swipe our cards, somehow they're getting our information? Can you explain that? I want to know what that is.

So the point-of-sale devices where you swipe your card through and punch in your PIN code and so forth.

Yep.

The original reports were that those were what was compromised. So, now, the way I see it, there's no way that 40,000 point-of-sale devices, which is what was reported, the actual physical devices were compromised, meaning that nobody swapped out all 40,000 devices. At least, I don't think that's possible. If all 40,000 devices were swapped out, that would be the largest organized crime in the history of mankind.

So then what do you think happened?

I think that the server that accesses all 40,000 devices— a single server, or, you know, a bank of servers had to have been infected that talks to each one of those 40,000 devices.

Let me ask you this. My wife went on today to check our account with the credit card for Target and could not get on. Now they're putting out this 800 number, but is it— when you can't get on and check your activity, is that because there's so many other people perhaps trying to do the same thing we're doing?

Oh yeah, no question about it. Target is being inundated today for good reason. So what I recommend that people do is if they have, you know, an online portal that they access either Target or their Visa, MasterCard, American Express, or Discover for that matter, you wanna go online and check to see if there is any unauthorized activity. So I do it online via my various banks, and I also do it via applications, mobile applications on my iPhone, so I can check as frequently as I want, as easy as I want, wherever I want. But you may have trouble getting into Target simply because of the volume of traffic they're gonna get today.

And they say they fixed the problem, though. But that's— still, you've gotta go back and go through your records meticulously.

So they might have fixed the actual breach. However, those numbers may very well still be in the hands of criminals. And what's probably gonna happen over the next coming weeks to months is many people, 40 million, could receive a letter in the mail along with a new credit card company from your issuing bank saying, "Hey, there's been a data breach. We believe that you were infected or affected," and ultimately they're gonna reissue new cards. Now, that may be months down the road, so you still have to pay very close attention to your statements and monitor each and every charge and reconcile daily diligently and timely. And in my opinion, you should become somewhat obsessed about this because if you don't, you very well may pay for the Christmas of an identity thief or hundreds or thousands of identity thieves, depending on how many have access to this data at this point.

Robert, you using cash only now? Because I think that's where I'm going next.

You know, I gotta tell you, I don't worry about credit card fraud. And I say that all the time 'cause I really don't. Now when I say be obsessed about, you know, about reconciling your statements. Yeah, you have to do that. But I use my credit card all the time and I don't worry about it. I just use it. But I do pay close attention to my statements. I reconcile them, you know, weekly at a minimum. And if I ever see fraudulent charges, I make a phone call, I send off an email, and they take it off the card. But that's really all you can and should do. But studies show 9 out of 10 people don't even look at their statements.

And we should. And this is a great lesson that we should do it right now, every one of us, whether we went to Target or not. Robert Siciliano, McAfee online security expert. Thank you so much, Robert. We always appreciate it. Thank you.

Thank you, Maria. Thank you, Mark.