The Incredibly Clever Way Thieves Stole 40 Million Credit Cards From Target Customers

Business Insider
Analyzing the top news stories across the web
Dec. 19 2013 11:53 AM

The Incredibly Clever Way Thieves Stole 40 Million Credit Cards From Target Customers

All told, the thieves targeted nearly 2,000 stores in the U.S. and in Canada.

Photo by Joe Raedle/Getty Images

This post originally appeared in Business Insider.


Forty-million people who used credit or debit cards at Target stores between Thanksgiving and Dec. 15 must now change their PIN numbers or passwords, or get new cards, following a nationwide hack of the retailer's checkout systems.

You may not like the fact that these hackers pulled off such a massive—and massively inconvenient—sting. But you've got to admire their ingenuity. First, note that the hack did not go through, the retailer's online website. If you shopped online at Target, your credit card info is probably safe.

Rather, the hackers went through the physical checkout systems inside every Target store. That's nearly 2,000 stores: 1,797 stores in the U.S. and another 124 in Canada. The hack focused on Target's point-of-sale, or POS system. As shoppers swiped or punched in their numbers on the checkout keypad, the hackers copied every single number, according to Brian Krebs, whose tech security blog has broken scoop after scoop on password hacking.

Previously, criminals who wanted to take credit card numbers and the PIN numbers that went with them would have to use a clumsy real-world subterfuge. They would fix a thin pad on top of an ATM's keypad, and capture both the credit card number as it swiped in and out through the pad's card slot plus the PIN as it was punched in on the keypad. Those numbers allow you to create dummy cards from "blank" cards with magnetic strips on them that can be used in ATMs or online to withdraw cash in exactly the same way a real card works.

But you can only get a few hundred cards a day that way, one machine at a time. And the hackers have to appear at the scene of the crime twice—once to install the pad and once to remove it—in order to get their numbers.

The Target thieves appear to have scaled up their skimming operation so that Target's POS system skimmed numbers across the entire store system. That probably involved installing malware that spread itself throughout Target's brick and mortar stores, according to the New York Times:

To pull it off, security experts said a company insider could have inserted malware into a company machine, or persuaded an unsuspecting employee to click on a malicious link that downloaded malware that gives cybercriminals a foothold into a company’s point-of-sale systems.

The thieves now have 40 million blank cards with correct numbers and PINs, and can withdraw cash from ATMs at their leisure.

A bunch of similar ripoffs have occurred at major retailers recently. Sixty-three Barnes & Noble stores were stung last year. In 2007, retailer TJ Maxx learned thieves used its store’s wireless networks to access systems at its headquarters where card data was stored. The thieves scooped 45 million cards. And in 2009, credit card processor Heartland Payment Systems lost 130 million card numbers when hackers installed malware on its internal systems.

Remarkably few people have been behind the ambitious heists. Back in July, prosecutors brought charges against five people—four Russians and a Ukrainian—who allegedly lifted 160 million credit cards from J.C. Penney, 7-Eleven, Nasdaq OMX Group, JetBlue, and others over several years.

Jim Edwards is a deputy editor at Business Insider. Follow him on Twitter.


The World

The Budget Disaster that Sabotaged the WHO’s Response to Ebola

Are the Attacks in Canada a Sign of ISIS on the Rise in the West?

PowerPoint Is the Worst, and Now It’s the Latest Way to Hack Into Your Computer

Is It Offensive When Kids Use Bad Words for Good Causes?

Fascinating Maps Based on Reddit, Craigslist, and OkCupid Data


The Real Secret of Serial

What reporter Sarah Koenig actually believes.


The Actual World

“Mount Thoreau” and the naming of things in the wilderness.

In Praise of 13th Grade: Why a Fifth Year of High School Is a Great Idea

Can Democratic Sen. Mary Landrieu Pull Off One More Louisiana Miracle?

  News & Politics
Oct. 23 2014 3:55 PM Panda Sluggers Democrats are in trouble. Time to bash China.
Business Insider
Oct. 23 2014 2:36 PM Take a Rare Peek Inside the Massive Data Centers That Power Google
Atlas Obscura
Oct. 23 2014 1:34 PM Leave Me Be Beneath a Tree: Trunyan Cemetery in Bali
  Double X
The XX Factor
Oct. 23 2014 11:33 AM Watch Little Princesses Curse for the Feminist Cause
  Slate Plus
Oct. 23 2014 11:28 AM Slate’s Working Podcast: Episode 2 Transcript Read what David Plotz asked Dr. Meri Kolbrener about her workday.
Brow Beat
Oct. 23 2014 4:03 PM You’re Doing It Wrong: Puttanesca Sauce
Oct. 23 2014 4:36 PM Vampire Porn Mindgeek is a cautionary tale of consolidating production and distribution in a single, monopolistic owner.
  Health & Science
Bad Astronomy
Oct. 23 2014 7:30 AM Our Solar System and Galaxy … Seen by an Astronaut
Sports Nut
Oct. 20 2014 5:09 PM Keepaway, on Three. Ready—Break! On his record-breaking touchdown pass, Peyton Manning couldn’t even leave the celebration to chance.