Cards Stolen in Target Breach Flood Underground Markets
Credit and debit card accounts stolen in a recent data breach at retail giant Target have been flooding underground black markets in recent weeks, selling in batches of one million cards and going for anywhere from $20 to more than $100 per card, KrebsOnSecurity has learned.
Context & Ripple Effects
This closes a three-day arc that KrebsOnSecurity itself opened: the outlet first reported on December 18 that Target was investigating a possible breach, and Target confirmed on December 19 that 40 million customer accounts were compromised with card numbers, expiration dates, CVVs and names exposed. What is new here is monetization — the stolen data did not sit still, it went straight to market.
The pickup was unusually broad even by breach standards: NYT Bits, TechCrunch, CNET, The Verge, Forbes, VentureBeat, BGR and Examiner all carried the story on or about December 20, reflecting how large the affected population of cardholders is. The reported pricing — $20 to more than $100 per card in batches of one million — implies the dumps include the full data needed for counterfeit-card use, not just numbers.
First-order effects
- Banks and credit unions that issued the 40 million compromised cards now bear immediate reissuance and fraud-monitoring costs, while their customers face real counterfeit-fraud risk since CVV data was taken alongside the numbers.
- Card thieves gain an unusually liquid inventory: million-card batches at $20–$100 per card give resellers a ready market, meaning fraud attempts will spike well before most affected cardholders receive replacement cards.
Second-order effects
- Issuers' reissuance costs and fraud losses land back on the retail ecosystem through chargebacks and interchange disputes, sharpening the question of who pays when a merchant's point-of-sale systems are the origin of a mass compromise.
- Competing retailers face heightened scrutiny of their own POS security, since the Target disclosure demonstrates that magnetic-stripe infrastructure at any major chain can yield millions of fully exploitable card records in one incident.
Third-order effects
- If the pattern holds — massive stripe-data breaches followed by fast underground monetization — pressure will build in the US to accelerate migration away from easily cloned magnetic stripes toward chip-based cards, with the industry fighting over where liability for such breaches sits.
- The speed from intrusion to liquid market establishes a template for breach economics: attackers optimize for data that monetizes in days, which structurally favors payment-card targets over slower-to-monetize record types.
The trend: Large-scale retail payment breaches are compressing the gap between data theft and underground monetization to days, shifting fraud costs toward issuers and intensifying the push to replace magnetic-stripe cards.