The Incredibly Clever Way Thieves Stole 40 Million Credit Cards From Target Customers

Analyzing the top news stories across the web
Dec. 19 2013 11:53 AM

The Incredibly Clever Way Thieves Stole 40 Million Credit Cards From Target Customers

All told, the thieves targeted nearly 2,000 stores in the U.S. and in Canada.

Photo by Joe Raedle/Getty Images

This post originally appeared in Business Insider.


Forty-million people who used credit or debit cards at Target stores between Thanksgiving and Dec. 15 must now change their PIN numbers or passwords, or get new cards, following a nationwide hack of the retailer's checkout systems.

You may not like the fact that these hackers pulled off such a massive—and massively inconvenient—sting. But you've got to admire their ingenuity. First, note that the hack did not go through, the retailer's online website. If you shopped online at Target, your credit card info is probably safe.

Rather, the hackers went through the physical checkout systems inside every Target store. That's nearly 2,000 stores: 1,797 stores in the U.S. and another 124 in Canada. The hack focused on Target's point-of-sale, or POS system. As shoppers swiped or punched in their numbers on the checkout keypad, the hackers copied every single number, according to Brian Krebs, whose tech security blog has broken scoop after scoop on password hacking.

Previously, criminals who wanted to take credit card numbers and the PIN numbers that went with them would have to use a clumsy real-world subterfuge. They would fix a thin pad on top of an ATM's keypad, and capture both the credit card number as it swiped in and out through the pad's card slot plus the PIN as it was punched in on the keypad. Those numbers allow you to create dummy cards from "blank" cards with magnetic strips on them that can be used in ATMs or online to withdraw cash in exactly the same way a real card works.

But you can only get a few hundred cards a day that way, one machine at a time. And the hackers have to appear at the scene of the crime twice—once to install the pad and once to remove it—in order to get their numbers.

The Target thieves appear to have scaled up their skimming operation so that Target's POS system skimmed numbers across the entire store system. That probably involved installing malware that spread itself throughout Target's brick and mortar stores, according to the New York Times:

To pull it off, security experts said a company insider could have inserted malware into a company machine, or persuaded an unsuspecting employee to click on a malicious link that downloaded malware that gives cybercriminals a foothold into a company’s point-of-sale systems.

The thieves now have 40 million blank cards with correct numbers and PINs, and can withdraw cash from ATMs at their leisure.

A bunch of similar ripoffs have occurred at major retailers recently. Sixty-three Barnes & Noble stores were stung last year. In 2007, retailer TJ Maxx learned thieves used its store’s wireless networks to access systems at its headquarters where card data was stored. The thieves scooped 45 million cards. And in 2009, credit card processor Heartland Payment Systems lost 130 million card numbers when hackers installed malware on its internal systems.

Remarkably few people have been behind the ambitious heists. Back in July, prosecutors brought charges against five people—four Russians and a Ukrainian—who allegedly lifted 160 million credit cards from J.C. Penney, 7-Eleven, Nasdaq OMX Group, JetBlue, and others over several years.



Don’t Worry, Obama Isn’t Sending U.S. Troops to Fight ISIS

But the next president might. 

The Extraordinary Amicus Brief That Attempts to Explain the Wu-Tang Clan to the Supreme Court Justices

Amazon Is Officially a Gadget Company. Here Are Its Six New Devices.

The Human Need to Find Connections in Everything

It’s the source of creativity and delusions. It can harm us more than it helps us.

How Much Should You Loathe NFL Commissioner Roger Goodell?

Here are the facts.

Altered State

The Plight of the Pre-Legalization Marijuana Offender

What should happen to weed users and dealers busted before the stuff was legal?

Surprise! The Women Hired to Fix the NFL Think the NFL Is Just Great.

You Shouldn’t Spank Anyone but Your Consensual Sex Partner

Sept. 17 2014 5:10 PM The Most Awkward Scenario in Which a Man Can Hold a Door for a Woman
  News & Politics
Altered State
Sept. 17 2014 11:51 PM The Plight of the Pre-Legalization Marijuana Offender What should happen to weed users and dealers busted before the stuff was legal?
Business Insider
Sept. 17 2014 1:36 PM Nate Silver Versus Princeton Professor: Who Has the Right Models?
Dear Prudence
Sept. 18 2014 6:00 AM All Shook Up My 11-year-old has been exploring herself with my “back massager.” Should I stop her?
  Double X
The XX Factor
Sept. 17 2014 6:14 PM Today in Gender Gaps: Biking
  Slate Plus
Slate Fare
Sept. 17 2014 9:37 AM Is Slate Too Liberal?  A members-only open thread.
Brow Beat
Sept. 17 2014 8:25 PM A New Song and Music Video From Angel Olsen, Indie’s Next Big Thing
Future Tense
Sept. 17 2014 9:00 PM Amazon Is Now a Gadget Company
  Health & Science
Bad Astronomy
Sept. 18 2014 7:30 AM Red and Green Ghosts Haunt the Stormy Night
Sports Nut
Sept. 17 2014 3:51 PM NFL Jerk Watch: Roger Goodell How much should you loathe the pro football commissioner?