Target announced today that credit and debit card information of as many as 40 million customers was stolen during the busiest shopping time of year. The breach, touted as one of the largest ever in American history, included customer names, card numbers, expiration dates, and the validation codes - everything a cyber criminal would need to create counterfeit credit cards.
The information from magnetic stripes, known as “track data,” is extremely valuable on the black market. It essentially allows criminals to encode that data onto any card with a magnetic stripe. If PIN codes were also intercepted, that would allow criminals to withdraw the cash of unsuspecting customers from ATMs.
Target, with almost $72 billion in U.S. sales last year, is the third-largest store in America, trailing only Walmart and the Kroger grocery store chain. Target has about 1,800 stores in the United States.
“Target’s first priority is preserving the trust of our guests and we have moved swiftly to address this issue, so guests can shop with confidence,” said Gregg Steinhafel, Target’s president and CEO.
“We regret any inconvenience this may cause,” he said. “We take this matter very seriously and are working with law enforcement to bring those responsible to justice.”
Data breaches are expensive for retailers. TJX Cos., which operates T.J. Maxx and Marshalls, paid $9.75 million in a settlement with states in June 2009, although the company said at the time that it believed it did not violate any consumer protection or data security laws.
Many businesses do not have the financial strength of a company the size of Target, so if faced with a large data breach, it could mean financial ruin for that business. It’s a very good idea to have a conversation with your broker about the cyber exposures that you might have. Proper safeguards could mean the difference in whether or not your business survives the financial and reputational damage of a breach.
