Target Got Me

[blas]

My parents got a letter from their bank saying they'd been compromised, and they're getting a new debit card.

[ADoyle90815]

I paid cash when I went to Target during that period, so I know I have nothing to worry about.

[Ophbalance]

Not a US resident: what's this insanely inappropriate response?
Inquiring minds want to know.

Others have pointed out some of the myriad of reasons. But to have 40 million guaranteed breached cards, and their only real response is "it's on you to monitor it" is an absolute failure in my opinion. At the barest minimum they should be offering free credit monitoring for those affected (big $$$, but much better good will gesture). They still haven't given a 100% "this is all that was captured" that I'm aware of. I've seen sites claiming it's everything on the mag strip, and the CVV, and address info, and PIN. Others don't include some of the above. If they've compromised your PIN, is it enough to just get new cards, or do you also need to change out your PIN?

So much fallout could come from this, and their best answer is "ya'll are on your own!" just bites hard. Target will likely upgrade that statement over time, but for now it's just pathetic.

[fma_fanatic]

Yes, and now those stolen accounts are showing up on the black market for sale, and oh yes, let's not forget the lawsuits filed because of the fiasco.

[Food Lady]

I asked one of the managers about my Target checkcard. She said that those PINs were never unsecured, so even if someone has my checkcard #, it's useless to him. I don't know about the Target credits. If I had used my regular debit, I'd cancel it. Seems simple enough.

[Irving Patrick Freleigh]

At the barest minimum they should be offering free credit monitoring for those affected (big $$$, but much better good will gesture).

According to this, they are.

As if that's a solution. Now on top of the hassle of closing accounts and getting new cards, your information goes to a company that will send you "targeted advertising" in return for credit monitoring services later.

[Ophbalance]

I'm already seeing targeted stuff, purporting to come from my bank, that I would presume is related to this. Joy oh joy.

[fma_fanatic]

I got a new debit card today, just to be safe. I can nao haz kitties! (the credit union I use now gives its members picture cards )

[Teskeria]

PayPal is actually monitoring their customers cards if they were used at Target between the vulnerable dates. (i think they added a day before and after the announced dates. I know because I have their debit mastercard for my own PayPal account. I like the cash back.
I talked to them and was told I could request a replacement if I wanted and they also told me there are a couple new scams related to the hack.
1. More emails being sent to log into your account using the link to 'verify' everything. Not from them. PayPal doesn't usually send links anyway so that one doesnt worry me.
2. phone calls pretending to be from the credit card company or the credit card processor 'verifying' information to 'be sure your card isnt compromised'.

[wolfie]

One thing I read about this is that the crooks got CCV codes (the printed number on the signature panel) among other things. My understanding is that the CCV code is intended ONLY for "card not present" transactions (phone/internet orders, etc.), to prove that you have the card in your possession (number is not encoded on the mag stripe, so reading the printed number is the only way to get it). The cards in question were used in "card present" (person in the store) transactions, so why the hell did Target HAVE the CCV codes in the first place?

These "bulk data thefts" seem to be a regular occurrence. Why don't stores realize that credit card data should NOT be kept on a computer that's connected to the internet? I'd like to see a news story along the lines of "Hackers got into our system, but since it was designed for security, the only data they were able to grab was queued transactions that hadn't made it onto the secure storage - credit cards used at store location X between 11:10 and 11:15 are compromised, all others are unaffected".

[mhkohne]

One thing I read about this is that the crooks got CCV codes (the printed number on the signature panel) among other things. My understanding is that the CCV code is intended ONLY for "card not present" transactions (phone/internet orders, etc.), to prove that you have the card in your possession (number is not encoded on the mag stripe, so reading the printed number is the only way to get it). The cards in question were used in "card present" (person in the store) transactions, so why the hell did Target HAVE the CCV codes in the first place?

I wonder if that part is a reporting error? Because I didn't think the CCV was anywhere on the mag stripe, so short of employees typing it (and at target they don't normally touch the card), or cameras being in places they shouldn't be, there shouldn't be a way to get that. Unless it can be computed from the stripe data somehow, which seems unlikely.

[Cia]

They got my CCV code because I watched the CSR entered it.

My bank has a note on their website that they are constantly monitoring the credit and debit cards. I still called and asked for a new number and told the CSR that with my hubby also using his card at the magic money machines and not knowing whose card was used for a particular transaction at a MMM, it gives me a greater piece of mind just to get a new check card number. Considering I had my most favorite credit card number stolen two years ago I'm overly cautious in this regard - it ended in 666 a credit card that knows it's evil!

At work we have a computer paygateway for credit cards but I don't enter the CCV codes since most of the cards we receive are from the Feds and they don't allow their personnel to give those codes out and the paygateway doesn't require me to type it in. We also don't keep a record anywhere of the credit card numbers our customers give us over the phone or in person. If I need to write the number down the paper goes into the shredder as soon as I e-mail or fax the customer the receipt.

[Silent-Hunter]

The only reason I can think of that Target would store the credit card data is for data mining, so they know who's bought what. In light of stuff like this, the governent should just make it a crime to even keep this kind of data. Once the card gets verified by the system and the transaction is complete, all the data should be sent to /dev/null or something.

[raudf]

I wonder if that part is a reporting error? Because I didn't think the CCV was anywhere on the mag stripe, so short of employees typing it (and at target they don't normally touch the card), or cameras being in places they shouldn't be, there shouldn't be a way to get that. Unless it can be computed from the stripe data somehow, which seems unlikely.

Reading Wikipedia, there are two CCVs. A CCV1 which is encoded on the card's strip and thus can be hacked (thus used for fake credit cards.) And then there is the CCV2, which is used for the non-present purchases. Mind, this is Wikipedia and my basic understanding of it.

The reporter might have heard it was the CCV1, but is thinking the CCV2 codes?

[BookstoreEscapee]

I only use my Discover card at Target; I haven't done so yet but I'm considering asking for a new card. Hopefully they can give me my Chihuahua design still. My big concern with that is making sure my automatic payments get updated (I have two monthly bills that charge to my card and some others that are yearly or otherwise, though if SiriusXM can't charge me it won't be the end of the world, since I'm not sure I want to keep renewing it, anyway). I have checked my recent activity a few times and so far nothing fishy.

I did take them up on their 10% discount that one weekend, though I only spent about $24 anyway.