NEW YORK - With less than a week until Christmas, a real-life Grinch has stolen the credit and debit card information of about 40 million Target shoppers.
Target says anyone who made purchases by swiping cards at terminals in its U.S. stores between Nov. 27 and Dec. 15 may have had their accounts exposed. The stolen data includes customer names, credit and debit card numbers, card expiration dates and the three-digit security codes located on the backs of cards.
"The first thing I would try to do is remember if I had used a card at Target during that period of time," said Roger Stoesz, Operations Director of Technology and Consulting Services at KDV Weath Management Company in Bloomington. "Do not panic. The fraud detection systems that the large financial institutions have in place are very, very good. So, if your card gets used in some place you do not typically go to, it is likely to get blocked or there is a good chance it will get blocked."
The stolen information included Target store brand cards and major card brands such as Visa and MasterCard.
The data breach did not affect online purchases, the company said.
Stoesz urges Target customers to check their credit card statements for any unusual charges. "I would not wait for the paper statement to come at the end of the month," said Stoesz. "I would get on-line, if you have on-line access. Call the issuing company and see what transactions have been used.
"When you do look at your statement, look carefully at the local transactions because the people that frequently steal that information know how good the fraud detection systems are and there's a better chance they will use them locally."
Minnesota Commerce Commissioner Michael Rothman agreed that customer should check their statements. "I would also say they should continue to monitor for the next few months, because it might not happen right away, but it is absolutely critical that the family go through all their statements to make sure that there are no improper or fraudulent charges."
Here are some answers to the most common questions about the theft:
Q: I shopped at Target during that time. What should you do?
A: Check your credit card statements carefully. If you see suspicious charges, report the activity to your credit card companies and call Target at 866-852-8680. You can report cases of identity theft to law enforcement or the Federal Trade Commission.
You can get more information about identity theft on the FTC's website at www.consumer.gov/idtheft, or by calling the FTC, at (877) IDTHEFT (438-4338).
Q: How did the breach occur?
A: Target isn't saying how it happened. Industry experts note that companies such as Target spend millions of dollars each year on credit card security, making a theft of this magnitude particularly alarming.
Avivah Litan, a security analyst with Gartner Research, says given all the security, she believes the breach may have been an inside job.
Litan says Target's breach suggests that current security standards aren't working.
"It's really a wake-up call to the banking industry, but they never seem to wake up," she said.
James Lyne, global head of security research for the computer security firm Sophos, says something clearly went wrong with Target's security measures.
"Forty million cards stolen really shows a substantial security failure," he says. "This shouldn't have happened."
Q: Why is the Secret Service investigating?
A: While it's most famous for protecting the president, the Secret Service also is responsible for protecting the nation's financial infrastructure and payment systems. As a result, it has broad jurisdiction over a wide variety of financial crimes. It isn't uncommon for the agency to investigate major thefts involving credit card information.