The Incredibly Clever Way Thieves Stole 40 Million Credit Cards From Target Customers

Analyzing the top news stories across the web
Dec. 19 2013 11:53 AM

The Incredibly Clever Way Thieves Stole 40 Million Credit Cards From Target Customers

All told, the thieves targeted nearly 2,000 stores in the U.S. and in Canada.

Photo by Joe Raedle/Getty Images

This post originally appeared in Business Insider.


Forty-million people who used credit or debit cards at Target stores between Thanksgiving and Dec. 15 must now change their PIN numbers or passwords, or get new cards, following a nationwide hack of the retailer's checkout systems.

You may not like the fact that these hackers pulled off such a massive—and massively inconvenient—sting. But you've got to admire their ingenuity. First, note that the hack did not go through, the retailer's online website. If you shopped online at Target, your credit card info is probably safe.

Rather, the hackers went through the physical checkout systems inside every Target store. That's nearly 2,000 stores: 1,797 stores in the U.S. and another 124 in Canada. The hack focused on Target's point-of-sale, or POS system. As shoppers swiped or punched in their numbers on the checkout keypad, the hackers copied every single number, according to Brian Krebs, whose tech security blog has broken scoop after scoop on password hacking.

Previously, criminals who wanted to take credit card numbers and the PIN numbers that went with them would have to use a clumsy real-world subterfuge. They would fix a thin pad on top of an ATM's keypad, and capture both the credit card number as it swiped in and out through the pad's card slot plus the PIN as it was punched in on the keypad. Those numbers allow you to create dummy cards from "blank" cards with magnetic strips on them that can be used in ATMs or online to withdraw cash in exactly the same way a real card works.

But you can only get a few hundred cards a day that way, one machine at a time. And the hackers have to appear at the scene of the crime twice—once to install the pad and once to remove it—in order to get their numbers.

The Target thieves appear to have scaled up their skimming operation so that Target's POS system skimmed numbers across the entire store system. That probably involved installing malware that spread itself throughout Target's brick and mortar stores, according to the New York Times:

To pull it off, security experts said a company insider could have inserted malware into a company machine, or persuaded an unsuspecting employee to click on a malicious link that downloaded malware that gives cybercriminals a foothold into a company’s point-of-sale systems.

The thieves now have 40 million blank cards with correct numbers and PINs, and can withdraw cash from ATMs at their leisure.

A bunch of similar ripoffs have occurred at major retailers recently. Sixty-three Barnes & Noble stores were stung last year. In 2007, retailer TJ Maxx learned thieves used its store’s wireless networks to access systems at its headquarters where card data was stored. The thieves scooped 45 million cards. And in 2009, credit card processor Heartland Payment Systems lost 130 million card numbers when hackers installed malware on its internal systems.

Remarkably few people have been behind the ambitious heists. Back in July, prosecutors brought charges against five people—four Russians and a Ukrainian—who allegedly lifted 160 million credit cards from J.C. Penney, 7-Eleven, Nasdaq OMX Group, JetBlue, and others over several years.



Talking White

Black people’s disdain for “proper English” and academic achievement is a myth.

Hong Kong’s Protesters Are Ridiculously Polite. That’s What Scares Beijing So Much.

The One Fact About Ebola That Should Calm You: It Spreads Slowly

Operation Backbone

How White Boy Rick, a legendary Detroit cocaine dealer, helped the FBI uncover brazen police corruption.

A Jaw-Dropping Political Ad Aimed at Young Women, Apparently

The XX Factor
Oct. 1 2014 4:05 PM Today in GOP Outreach to Women: You Broads Like Wedding Dresses, Right?

How Even an Old Hipster Can Age Gracefully

On their new albums, Leonard Cohen, Robert Plant, and Loudon Wainwright III show three ways.

How Tattoo Parlors Became the Barber Shops of Hipster Neighborhoods

This Gargantuan Wind Farm in Wyoming Would Be the Hoover Dam of the 21st Century

Oct. 1 2014 8:34 AM This Gargantuan Wind Farm in Wyoming Would Be the Hoover Dam of the 21st Century To undertake a massively ambitious energy project, you don’t need the government anymore.
  News & Politics
Oct. 1 2014 7:26 PM Talking White Black people’s disdain for “proper English” and academic achievement is a myth.
Oct. 2 2014 8:07 AM The Dark Side of Techtopia
Oct. 2 2014 8:27 AM How Do Teachers Kill the Joy of Reading for Students?
  Double X
The XX Factor
Oct. 1 2014 5:11 PM Celebrity Feminist Identification Has Reached Peak Meaninglessness
  Slate Plus
Behind the Scenes
Oct. 1 2014 3:24 PM Revelry (and Business) at Mohonk Photos and highlights from Slate’s annual retreat.
Brow Beat
Oct. 1 2014 9:39 PM Tom Cruise Dies Over and Over Again in This Edge of Tomorrow Supercut
Future Tense
Oct. 1 2014 6:59 PM EU’s Next Digital Commissioner Thinks Keeping Nude Celeb Photos in the Cloud Is “Stupid”
  Health & Science
Bad Astronomy
Oct. 2 2014 7:30 AM What Put the Man in the Moon in the Moon?
Sports Nut
Oct. 1 2014 5:19 PM Bunt-a-Palooza! How bad was the Kansas City Royals’ bunt-all-the-time strategy in the American League wild-card game?