Angry Target customers expressed their displeasure in comments on the company's Facebook page. Some even threatened to stop shopping at the store. Target apologized on Facebook and said it's working hard to resolve the problem and is adding more workers to field calls and help solve website issues.
The fury and frustration come as America's second-largest discounter acknowledged Thursday that data connected to about 40 million credit and debit card accounts was stolen as part of a breach that began over the Thanksgiving weekend.
MORE: Target says PINS are not part of stolen credit card info
The theft is the second-largest credit card breach in U.S. history, exceeded only by a scam that began in 2005 involving retailer TJX. That incident affected at least 45.7 million card users.
Target disclosed the theft a day after reports that the company was investigating a breach. The retailer's data-security troubles and its ensuing public relations nightmare threaten to drive off holiday shoppers during the company's busiest time of year.
Customers who made purchases by swiping their cards at its U.S. stores between Nov. 27 and Dec. 15 may have had their accounts exposed. The stolen data included customer names, credit and debit card numbers, card expiration dates and the embedded code on the magnetic strip found on the backs of cards, Target said.
MORE: Retailer confirms details of massive data breach
There was no indication the three- or four-digit security numbers visible on the back of the card were affected, Target said. The data breach did not affect online purchases, the company said.
Eric Hausman, a Target spokesman, said the company is engaged in "an ongoing investigation."
Target hasn't disclosed exactly how the breach occurred but said it has fixed the problem.
Gi! ven the millions of dollars that companies such as Target spend implementing credit-card security measures each year, Avivah Litan, a security analyst with Gartner Research said she believes the theft may have been an inside job.
"The fact this breach can happen with all of their security in place is really alarming," Litan said.
Other experts theorize that Target's network was hacked and infiltrated from the outside.
Whatever the case, Jason Oxman, CEO of the Electronics Transaction Association, which represents the payments technology industry, said data breaches like Target's are generally "heavily organized and sophisticated."
Annual losses from global credit and debit card fraud are on the rise. Last year, it reached $11.27 billion, up 11.4% from the previous year, according to The Nilson Report, which tracks global payments. Even so, Nilson's publisher David Robertson pointed out that fraud still accounts for less than 6 cents of every $100 spent.
Target, which has almost 1,800 stores in the U.S. and 124 in Canada, said it immediately told authorities and financial institutions once it became aware of the breach on Dec. 15. The company is teaming with a third-party forensics firm to investigate and prevent future problems.
The credit card breach poses a serious problem and threatens to scare away shoppers who worry about the safety of their personal data.
Target's stock dropped more than 2%, or $1.40, to $62.15 on Thursday.
"This is close to the worst time to have it happen," said Jeremy Robinson-Leon, a principal at Group Gordon, a corporate and crisis public relations firm. "If I am a Target customer, I think I would be much more likely to go to a competitor over the next few days, rather than risk the potential to have my information be compromised."
The incident is particularly troublesome for Target because it has used its store-branded credit and debit cards as a marketing tool to attract shoppers with a 5% discount.
During an earni! ngs call ! in November, the company said some 20% of store customers as of October have the Target-branded cards. In fact, households that activate a Target-branded card have increased their spending at the store by about 50% on average, the company said.
TJX, which runs stores such as T.J. Maxx and Marshall's, had a breach that began in July 2005 and exposed at least 45.7 million credit and debit cards to possible fraud. The breach was not detected until December 2006.
Without anyone noticing, one or more intruders installed code on the discount retailer's systems to methodically collect and transmit account data from millions of cards.
In 2009, TJX agreed to pay $9.75 million in a settlement with multiple states.
AP Writers Michelle Chapman in New York and Heather Hollingsworth in Kansas City, Mo., contributed to this report.
No comments:
Post a Comment