A Target spokesperson announced January 10 that, in addition to the original 40 million customers hit by hackers, the personal information of as many as 70 million people, including names, addresses, emails and phone numbers, was also stolen between late November and early December.
Target first reported that the breach occurred between November 27and December 15, 2013 on the terminals where customers swiped credit and debit cards. As well, Target announced the only information hacked was stored in the magnetic strips on the back of customers' cards. But one week later Target said encrypted PIN data had also been obtained. Now it believes a larger breach occurred elsewhere in its customer infrastructure and that a marketing database was breached , not just its financial database as first believed. This means that names, mailing addresses, telephone numbers and email addresses were taken. Further, some victims didn’t even shop at Target during that time.
READ MORE Data Breach LEGAL NEWS
This data breach leaves customers questioning how it could have happened, and how much of the blame lies with the giant retailer. According to one article in the Los Angeles Times (January 10, 2014) companies like Target could prevent data breaches if they had better safeguards in place, but protecting privacy is expensive. Unfortunately for Target, data breach lawsuits are also expensive.
In an interview with The Times, Gregg Steinhafel, Target's chief executive said, "I know that it is frustrating for our guests to learn that this information was taken, and we are truly sorry they are having to endure this… I also want our guests to know that understanding and sharing the facts related to this incident is important to me and the entire Target team."
READER COMMENTS
christopher hicks
on
Brenda Rone
on
jossch
on
GARY WILBUR
on
RUSSIA+ TARGET = US
Christian Nielsen
on
It's hard to imagine how someone could get into the operating system of a cash register, but clearly not impossible if that is what happened.
Could Target be liable? We have to wait and see what steps they took to prevent such a thing from happening or if it was really something that happened in such a way as to be very, very hard to foresee. And I doubt the credit card companies could be successfully sued over this.
While I do agree with what the article says about additional safeguards might have presented this problem, it would depend on how the data was stolen, wouldn't it? Perhaps methods were used that would not have been covered this specific situation. Opinions are great, but let's not have our perception and attitudes colored too much by anything lacking facts.
Lastly, if the person or person's responsible were located in another country, shouldn't we ask why we allow computer systems to be accessed by locations were there is no business purpose to do so? If you don't do business with, or have content understandable by, those in a foreign country; would it not make sense to add to your security by restricting access from those locations? This simple concept is largely ignored in favor of having the Internet be open and free and instead relying on security methods to prevent any problems. In many cases, shouldn't we be doing both?
Daniel O'Cooney
on