Target apologizes for data breach, retailers embrace security upgrade (BLOG)

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVa84Bkx4LSmOG7Uu4y8k2bnN6H6AuYxFD5ySjNOZsz32xm-v9AJVg_vV3m1tqXbdvnf9QqZa5bIjvM996HmA2fc9JupqE6ViNFYVP_BO7HwlRSgTT2UQEZIQ2-1t8Q36gJikJsls1PH8/s1600/targ.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="214" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVa84Bkx4LSmOG7Uu4y8k2bnN6H6AuYxFD5ySjNOZsz32xm-v9AJVg_vV3m1tqXbdvnf9QqZa5bIjvM996HmA2fc9JupqE6ViNFYVP_BO7HwlRSgTT2UQEZIQ2-1t8Q36gJikJsls1PH8/s320/targ.JPG" width="320" /></a></div><div id="yui_3_9_1_1_1389638629115_6083" style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">By Ross Kerber, Phil Wahba and Jim Finkle</div><div id="yui_3_9_1_1_1389638629115_6065" style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">The company has so far disclosed that the breach started in late November and lasted 19 days over the peak holiday shopping season, resulting in the theft of about 40 million credit card records and 70 million other records containing customer data.BOSTON/NEW YORK (Reuters) - Target Corp began a major public relations effort on Monday to apologize to customers for an unprecedented cyber attack on its network, but the No. 3 U.S. retailer was vague in providing details about what it knew and when.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">Target is trying to woo back customers after sales dropped off at the end of the holiday season. Its campaign included full-page newspaper advertisements on Monday apologizing for the attack and the first interview since the breach by chief executive Gregg Steinhafel.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">He told CNBC TV business network that Target wanted to lead the retail industry's move to adopt payment card technology that stores customer information on computer chips and requires users to type in personal identification numbers.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">On Sunday, a top executive with the National Retail Federation called for tougher security standards that could mean more spending for the industry, its banks and business partners following the breaches at Target and other retailers in the United States.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">Steinhafel said he was proud of the way Target employees had responded once the breach was confirmed, yet he provided few details about what had happened.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">Target disclosed on December 19 that it was victim to one of the biggest credit card breaches on record. It said it ran for 19 days in the busy holiday shopping season through December 15.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">"We're going to get to the bottom of this," Steinhafel told CNBC. "We're not going to rest until we understand what happened and how that happened."</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">The company declined to say precisely when it first came to suspect its systems might have been compromised.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">In the CNBC interview, Steinhafel said the company "confirmed" that it had been victim of a breach on December 15, but he provided no account of what happened in preceding weeks.</div><div class="body-related" style="background-color: white; clear: right; float: right; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 10px; margin-left: 10px; position: relative;"><a class="body-related-link body-related-image go-to-slideshow-lightbox rapid-noclick-resp landscape onesize get-lbdata-from-dom" data-rapid_p="8" data-uuid="cfe4cb8b-ca09-3b3e-a98e-5b1bf310947f" href="http://news.yahoo.com/photos/file-photo-shopper-entering-neiman-marcus-store-oak-photo-172658284.html" style="color: #324fe1; cursor: pointer; display: block; margin: 0px auto; max-width: 300px; position: relative; text-decoration: none;" title="File photo of a shopper entering a Neiman Marcus store&nbsp;&hellip;"><div class="img-wrap" style="position: relative;"><div class="cta-overlay" style="-webkit-transition: background-color 0.24s linear; font-size: 13px; height: 224px; left: 0px; position: absolute; top: 0px; transition: background-color 0.24s linear; width: 300px;"><span class="clearfix title cta-text medium" style="-webkit-transition: opacity 0.24s linear; color: white; font-size: 16px; left: 5px; opacity: 0; position: absolute; top: 5px; transition: opacity 0.24s linear; white-space: pre-wrap; width: 270px; zoom: 1;"></span><span class="cta-text xsmall" style="-webkit-transition: opacity 0.24s linear; bottom: 5px; color: white; font-size: 16px; margin-left: 42px; opacity: 0; position: absolute; transition: opacity 0.24s linear;">View gallery</span><span class="icon-slideshow icon-white-slideshow-xsmall" style="-webkit-transition: opacity 0.16s linear; background-color: #324fe1; background-image: url(data:image/svg+xml; background-repeat: no-repeat no-repeat; background-size: cover; border-bottom-left-radius: 4px; border-bottom-right-radius: 4px; border-top-left-radius: 4px; border-top-right-radius: 4px; bottom: 5px; cursor: pointer; height: 23px; left: 5px; line-height: 0; opacity: 0; padding: 0px; position: absolute; text-indent: -1000em; transition: opacity 0.16s linear; width: 32px; z-index: 1;"></span></div><img alt="File photo of a shopper entering a Neiman Marcus store&nbsp;&hellip;" class="body-related-thumb" data-src-2x="" height="224" src="http://l1.yimg.com/bt/api/res/1.2/AxkkPnshsM7ACTIPL7ewiw--/YXBwaWQ9eW5ld3M7Zmk9ZmlsbDtoPTIyNDtxPTc1O3c9MzAw/http://media.zenfs.com/en_us/News/Reuters/2014-01-13T172658Z_5_CBREA0B07LJ00_RTROPTP_2_NEIMANMARCUS-DATABREACH.JPG" style="-webkit-transition: opacity 0.3333s ease 0ms; background-repeat: no-repeat no-repeat; border: 0px; display: block; opacity: 1 !important; transition: opacity 0.3333s ease 0ms; vertical-align: baseline; visibility: visible !important;" width="300" /></div></a><div class="body-related-title photo-caption" style="box-sizing: border-box; color: grey; font-size: 11px; line-height: 16px; margin: 0px auto; max-width: 100%; padding: 5px 5px 0px 0px; position: relative; width: 300px;">A shopper enters a Neiman Marcus store in Oak Brook, Illinois, a suburb of Chicago, in this May 2, 2 …</div></div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">"December 15. That was the day we confirmed that we had an issue," he said.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">Sources familiar with the investigation have previously told Reuters that Target learned about the attack only after receiving warnings from financial industry sources who reported seeing a surge in fraudulent credit card activity from accounts of customers who had shopped at the retailer.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">Another retailer, Neiman Marcus, disclosed on Friday that it was warned about a possible breach in mid-December and that an outside forensics firm confirmed a breach on January 1, saying it found evidence that some payment card data may have been compromised.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">Target and Neiman Marcus are not the only U.S. retailers whose networks were breached over the holidays, according to sources familiar with attacks on other merchants that have yet to be publicly disclosed.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">Smaller breaches at least three other well-known U.S. retailers took place over the holiday season and were conducted using similar techniques as the one on Target, according to the people familiar with the attacks. Similar breaches may have occurred earlier last year.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">Stores and card processing companies have reported a steady stream of security breaches for years without a major backlash from consumers, such as those disclosed by TJX Cos in 2007 and by Heartland Payment Systems Inc in 2009.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">But the latest thefts could mark a watershed moment for security standards as calls grow for changes in the protection of consumer information.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">'CHIP-AND-PIN' CARDS</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">One sign of the change is the new enthusiasm for "Chip-and-PIN" payment cards, which have computer chips built into them and require users to type in PINs.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">Mallory Duncan, general counsel of the National Retail Federation that represents Target, Wal-Mart and other stores, said on Sunday that the trade group encouraged its members to upgrade to the higher-security cards even though they cost more than old systems that store data on magnetic stripes.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">The breaches are "unfortunate but we're not entirely surprised," Duncan said at his organization's annual convention in New York.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">"The technology that exists in cards out there is 20th-century technology and we've got 21st-century hackers," he said.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">Duncan said the trade group had only made its backing for the higher-security cards public since the Target breach. Banks have quietly begun to offer the cards but mainly for customers to use while traveling. Big U.S. card networks led by Visa Inc will not require the higher security until next year at the earliest.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">It is not clear that "Chip-and-PIN" technology would have prevented the breaches at Target and elsewhere. At the very least they make stolen data harder to re-use, a reason the technology has caught on widely in Europe and Asia.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">They have met with much less enthusiasm in the United States, in part because losses to fraud - just 5 cents for every $100 spent via plastic - have been manageable for merchants and their banks. But rising fraud rates, and the risk of identity theft, could change the calculation.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">The new scrutiny began after Target disclosed its breach. Investigators believe hackers used malware that captured data on customers from the magnetic stripes on their payment cards.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">Duncan said no other members had told the NRF they had been breached.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">Executives of several other companies said over the weekend that they were not aware of breaches at their companies. The executives included representatives of Sears Holdings Corp, JCPenney Co, Macy's Inc and Gap Inc.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">Still, the breach was the talk of the retail conference with 29,000 attendees. Several speakers cited it in remarks and some tried to distance their companies from vulnerabilities.</div><div style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">Stan Lippelman, vice president of marketing at Bass Pro Shops, a privately-held outdoor goods seller, said: "We feel very comfortable with where we are at. But...the fact that it happens to Target means it can happen to anybody, right?"</div><div id="yui_3_9_1_1_1389638629115_6709" style="background-color: white; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24px; margin-bottom: 1.1em;">(Additional reporting by Dhanya Skariachan in New York,; Bill Trott in Washington and; Sruthi Ramakrishnan in Bangalore; Editing by Stephen Coates and Grant McCool)</div></div>

Target apologizes for data breach, retailers embrace security upgrade (BLOG)

By Ross Kerber, Phil Wahba and Jim Finkle The company has so far disclosed that the breach started in late November and lasted 19 days over ...

Read more »