Friday, December 20, 2013

Data from Target credit card theft has been in online 'card shops' for weeks: Report

If you shopped at Target between Nov. 27 and Dec. 15 and are now -- after the retailer's announcement that as many as 40 million credit and debit card accounts were stolen from its POS systems -- wondering where those card numbers end up, Krebs on Security had the answer on Friday. In an unsettling but unsurprising report, the site detailed how data from Target's breach is flooding underground credit card black markets, and have been doing so for weeks.

The report said:
Credit and debit card accounts stolen in a recent data breach at retail giant Target have been flooding underground black markets in recent weeks, selling in batches of one million cards and going for anywhere from $20 to more than $100 per card.
The report detailed the process by which a specific and unnamed bank went about trying to buy some of its card numbers back from one of the (ironically) "more trusted" card shops. The site and "checkout" process are so nicely coded that the site will even check the credit card data as a sale is made, automatically refunding funds for any cards that are found to be flagged.

Later in the day, Target -- as expected, and as has been done by other companies with similar breaches -- announced it would provide free credit monitoring for any customers affected.
We want our guests to understand that just because they shopped at Target during the impacted time frame, it doesn’t mean they are victims of fraud. In fact, in other similar situations, there are typically low levels of actual fraud. Most importantly, we want to reassure guests that they will not be held financially responsible for any credit and debit card fraud. And to provide guests with extra assurance, we will be offering free credit monitoring services. We will be in touch with those impacted by this issue soon on how and where to access the service.
Target also reassured customers that they would not be responsible for any fraudulent charges, thanks to consumer protection laws.

As past victims of such ID theft, that type of protection, while reassuring, is offset by the annoyance and anxiety created by having to check your credit card statements. In particular, these sorts of things are especially painful for those who have attached their cards to automatic payments, and have to track down and change those payments.

No comments: