Estimated read time: 4-5 minutes
This archived news story is available only for your personal, non-commercial use. Information in the story may be outdated or superseded by additional information. Reading or replaying the story in its archived form does not constitute a republication of the story.
NEW YORK (AP) — Target said Friday that its massive pre-Christmas security breach affected potentially millions more people than it previously thought.
Target Corp. disclosed last month that about 40 million credit and debit cards may have been affected by the breach that occurred between Nov. 27 and Dec. 15. But according to new information released Friday, those criminals also stole personal information _ including names, phone numbers as well as email and mailing addresses _ from as many as 70 million customers who could have shopped at stores outside of that timeframe.
Some overlap exists between the two data sets.
Here's what you need to know if you think you're a potential victim:
___
Q: How did this happen?
A: Target has said that the breach was caused by malware that affected its U.S. stores.
Ken Stasiak, founder and CEO of SecureState, a Cleveland-based information security firm that investigates data breaches like this one, says it's likely that the perpetrators infiltrated Target's main information hub with malware and from there were able to access the store point-of-sale systems. Once the malware was in the POS systems, it could collect credit and debit card numbers as the cards were swiped.
Stasiak notes that retailers routinely collect personal information such as addresses, emails and phone numbers through things such as rewards cards when sales are made, so that information is also contained on POS systems just like credit card numbers.
Q: If my card number gets stolen, what exactly am I on the hook for?
A: In most cases consumers aren't responsible for fraudulent credit card charges.
Credit card companies are often able to flag the charges before they go through and shut down your card. If that doesn't happen, the card issuer will generally strip charges you claim are fraudulent off your card immediately. Usually the worst thing consumers have to deal with is the hassle of getting a new credit card.
But since debit cards don't come with all of the same protections, holders of those kinds of cards may have a harder time getting their money back.
And the banks and credit card companies ultimately won't be stuck with the bills, either. Since the fraud has been tied to Target, the retailer will be responsible for compensating them.
Q: What are the odds that my identity will be stolen?
A: There's no way to know. But Stasiak says the revelation that personal information was taken in addition to card numbers makes it much more likely that the thieves weren't just out to steal credit card numbers for financial gain.
For instance, criminals could use that personal information to send specific phishing emails to Target shoppers that prompt them to click on links that send malware to their own computers and steal even more information.
And identity theft damage could be much harder for victims to repair than credit card fraud. In addition, if the theft is discovered months or even years down the road, it will be much harder to tie to the Target breach, Stasiak says.
Q: What should I do to protect myself?
A: Consumers who think they may be affected should check their credit card statements carefully for potentially fraudulent charges. Experts say in cases like this when a huge amount of information is stolen, the thieves often sell it on the black market to the highest bidder. As a result, it could be a while before someone tries to use the information for nefarious purposes.
If you see suspicious charges, report the activity to your credit card companies and call Target at 866-852-8680. You can report cases of identity theft to law enforcement or the Federal Trade Commission.
Stasiak says that since it could be a long time before identity theft victims even realize they've been hit, people should take Target up on its offer of free credit monitoring. Those services, for instance, inform consumers if someone takes out a loan in their name.
He also advises potential victims to change email passwords and to make sure that the same passwords aren't being used for other accounts like Facebook. And while the company has not said that its website was compromised in the attack, he says shoppers also should change their passwords related to those, since it's apparent that Target doesn't yet have a full grasp of the damage.
Consumers can get more information about identity theft on the FTC's website at http://www.consumer.gov/idtheft, or by calling the FTC, at 877- IDTHEFT (438-4338).
___
Bree Fowler can be reached at http://twitter.com/APBreeFowler
(Copyright 2014 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.)
