The Incredibly Clever Way Thieves Stole 40 Million Credit Cards From Target Customers

Analyzing the top news stories across the web
Dec. 19 2013 11:53 AM

The Incredibly Clever Way Thieves Stole 40 Million Credit Cards From Target Customers

All told, the thieves targeted nearly 2,000 stores in the U.S. and in Canada.

Photo by Joe Raedle/Getty Images

This post originally appeared in Business Insider.


Forty-million people who used credit or debit cards at Target stores between Thanksgiving and Dec. 15 must now change their PIN numbers or passwords, or get new cards, following a nationwide hack of the retailer's checkout systems.

You may not like the fact that these hackers pulled off such a massive—and massively inconvenient—sting. But you've got to admire their ingenuity. First, note that the hack did not go through, the retailer's online website. If you shopped online at Target, your credit card info is probably safe.

Rather, the hackers went through the physical checkout systems inside every Target store. That's nearly 2,000 stores: 1,797 stores in the U.S. and another 124 in Canada. The hack focused on Target's point-of-sale, or POS system. As shoppers swiped or punched in their numbers on the checkout keypad, the hackers copied every single number, according to Brian Krebs, whose tech security blog has broken scoop after scoop on password hacking.

Previously, criminals who wanted to take credit card numbers and the PIN numbers that went with them would have to use a clumsy real-world subterfuge. They would fix a thin pad on top of an ATM's keypad, and capture both the credit card number as it swiped in and out through the pad's card slot plus the PIN as it was punched in on the keypad. Those numbers allow you to create dummy cards from "blank" cards with magnetic strips on them that can be used in ATMs or online to withdraw cash in exactly the same way a real card works.

But you can only get a few hundred cards a day that way, one machine at a time. And the hackers have to appear at the scene of the crime twice—once to install the pad and once to remove it—in order to get their numbers.

The Target thieves appear to have scaled up their skimming operation so that Target's POS system skimmed numbers across the entire store system. That probably involved installing malware that spread itself throughout Target's brick and mortar stores, according to the New York Times:

To pull it off, security experts said a company insider could have inserted malware into a company machine, or persuaded an unsuspecting employee to click on a malicious link that downloaded malware that gives cybercriminals a foothold into a company’s point-of-sale systems.

The thieves now have 40 million blank cards with correct numbers and PINs, and can withdraw cash from ATMs at their leisure.

A bunch of similar ripoffs have occurred at major retailers recently. Sixty-three Barnes & Noble stores were stung last year. In 2007, retailer TJ Maxx learned thieves used its store’s wireless networks to access systems at its headquarters where card data was stored. The thieves scooped 45 million cards. And in 2009, credit card processor Heartland Payment Systems lost 130 million card numbers when hackers installed malware on its internal systems.

Remarkably few people have been behind the ambitious heists. Back in July, prosecutors brought charges against five people—four Russians and a Ukrainian—who allegedly lifted 160 million credit cards from J.C. Penney, 7-Eleven, Nasdaq OMX Group, JetBlue, and others over several years.


Medical Examiner

Here’s Where We Stand With Ebola

Even experienced international disaster responders are shocked at how bad it’s gotten.

It Is Very, Very Stupid to Compare Hope Solo to Ray Rice

The U.S. Is So, So Far Behind Europe on Clean Energy

Even if You Don’t Like Batman, You Might Like Gotham

Friends Was the Last Purely Pleasurable Sitcom

The Eye

This Whimsical Driverless Car Imagines Transportation in 2059


Meet the New Bosses

How the Republicans would run the Senate.

A Woman Who Escaped the Extreme Babymaking Christian Fundamentalism of Quiverfull

Nobody Knows How Many Gay Married Couples Live in America—Not Even the Census Bureau

  News & Politics
Sept. 22 2014 6:30 PM What Does It Mean to Be an American? Ted Cruz and Scott Brown think it’s about ideology. It’s really about culture.
Sept. 22 2014 5:38 PM Apple Won't Shut Down Beats Music After All (But Will Probably Rename It)
Sept. 22 2014 4:45 PM Why Can’t the Census Count Gay Couples Accurately?
  Double X
Sept. 22 2014 4:06 PM No, Women’s Soccer Does Not Have a Domestic Violence Problem Or, why it is very, very stupid to compare Hope Solo to Ray Rice.
  Slate Plus
Slate Plus
Sept. 22 2014 1:52 PM Tell Us What You Think About Slate Plus Help us improve our new membership program.
Brow Beat
Sept. 22 2014 5:45 PM The University of California Corrects “Injustice” by Making Its Rich Chancellors Even Richer
Future Tense
Sept. 22 2014 6:27 PM Should We All Be Learning How to Type in Virtual Reality?
  Health & Science
Medical Examiner
Sept. 22 2014 4:34 PM Here’s Where We Stand With Ebola Even experienced international disaster responders are shocked at how bad it’s gotten.
Sports Nut
Sept. 18 2014 11:42 AM Grandmaster Clash One of the most amazing feats in chess history just happened, and no one noticed.