Robert Siciliano, an identity theft expert, explains how Target's breach exposed 40 million credit card records during holiday shopping. Hackers likely entered through a vendor connection, and the stolen data will probably be sold on the dark web within weeks.
Chapters
Straight ahead, worst Christmas gift ever? Up to 40 million people who went holiday shopping at Target had their credit card info hacked. How does that happen and what's being done about it? Now a crisis in the retail world as Target, the third largest American retailer, had data on 40 million credit cards stolen just as the holiday season began. Anyone who shopped at Target from the day before Thanksgiving through this past Sunday could be affected. Joining us from Boston, Massachusetts is Robert Siciliano, a personal security and identity theft expert and the CEO of IDTheftSecurity.com. Robert, great to have you with us. This is—
thank you so much—
this is the second largest credit card breach in history. How does something like this happen?
Yeah, this is a big deal, uh, and the way it looks, that criminals maybe got access to a server that is responsible for processing all the credit card transactions within the retailer. So the bad guys basically got access to the mainframe, the main server that, you know, it sees all that data all year long.
And the hacking took place over a period of 2 weeks. Why weren't any red flags raised during that time? And in fact, Target didn't figure this out itself.
Yeah, they were alerted by others that there was a breach. So I'm not on the inside, so I don't know what systems they have in place to scan and to alert them. But more than likely, the nature of the breach was such a sophisticated one that it bypassed their systems and it bypassed their scanners. Generally, these organizations have technology that scans for flaws, for malware, on a minute-by-minute basis, at least daily. And, uh, it looks like that, that did not discover, what had occurred.
And so what do these guys who get this information, these hackers, do? Will they basically get credit cards and turn them into their own credit cards and be able to charge things on our accounts?
Well, that would be the best-case scenario for them, yes. They would clone the actual cards and go ahead and make charges and/or make cash withdrawals. In some cases, place orders online and so forth to get products and services and turn that stuff into cash. They will also broker this data, which means that they will sell blocks of 10,000 or more credit card numbers to others for really just pennies, who will then go ahead and use it to, you know, make credit cards or make charges and so forth. But the fact is, with 40 million credit cards, they're probably not going to get to all of them before the actual credit card companies cancel those cards and reissue new ones.
Do you think they're going to do that? Given that I'm one of those 40 million who shopped at Target in that period of time, what does this mean for consumers? Are we all going to see notices messages from our credit card companies that our credit cards have been canceled.
Yeah, I am one of those consumers, and so is my wife. My wife said, you know, what should I do? Should I not go to Target? And I said, go to Target, you know, don't worry about it. Just pay attention to your credit card statement. And more than likely, we will get new credit cards like you. And because if they notice 40 million, then chances are they know that there's 40 million numbers. They know what those numbers are, and they will turn around and they will contact all of the issuing banks and say, hey, you were part of our breach. And then those credit card companies will reach out to the consumers, you and I, and they'll issue us new cards with a letter saying, hey, we think your credit card was involved in a breach. And you'll get that anywhere from the next 3 weeks to 3 months or more.
So you don't think it's going to interrupt our shopping just as the holiday season is reaching its big moments?
Yeah, I don't think that they'll just go ahead and cancel all those cards in the next say, week or two. I do think that it will take some time to flesh out what card numbers, you know, were breached at what banks and so forth. So over the next, you know, 3 weeks to, say, 3 months to 6 months, that's when most people will get all their notifications.
So people like you and me who shopped at Target in that period of time, what should we do to protect ourselves?
So there's nothing that you can do proactively because the damage is done. Otherwise, you check your statements. I check my statements online weekly. I do that all year long. Some people check their statements monthly via their paper statements, and I also check my statements via a mobile application on my iPhone. So American Express and Citibank and Bank of America and others, they all offer you a mobile application you can check in every single day, and you can see, you know, the balance on your credit cards, your balance on your bank statements, check if there's any unauthorized activity and so forth. You know, people who check their Facebook page 10 times a day but never check their credit card statements online, I think they have their priorities a little messed up.
So are retailers in general doing enough to protect their customers?
So retailers themselves fall under the payment card industry standards, meaning that they have rules and regs set by governing bodies that require them to have minimum standards of security. And the majority of the big retailers, you know, far exceed the minimums and go way beyond that. It's the smaller moms and pops that may not have the resources that don't meet up to the minimums of the payment card industry standards. An organization like Target They're doing everything they're supposed to, or at least they should be. My guess is that they are, to protect our information on their servers.
Well, but they obviously got it from them. I mean, can they prevent something like this from happening again? We just keep hearing about these hackers, you know, the Syrian, uh, those hackers from Syria who managed to take down all sorts of websites in the United States. We've got some very sophisticated people out there. Are they going to keep finding ways around any security that retailers come up with?
That is their job to do so. So keep in mind, in the security industry, we say that there's no such thing as 100% security, that security is a journey, it's not a destination. You never arrive, fully arrive there, but you strive for that. So there's always going to be a way in, and the security professional's job is to minimize the risks. And our job as consumers is to minimize our risks too.
How much, though, can they minimize those risks? We only have about 30 seconds left.
They've done a pretty good job thus far. I mean, this is the first Target breach in so many years. We haven't seen major retailers breach like this in quite some time now, and they're getting much better at protecting our data, and I think going forward they will.
Let's hope that's the case. Robert Siciliano, great to see you. Thank you very much for joining us tonight.
