Target Denies Report That PINs Were Stolen In Data Breach
NEW YORK (CBSNewYork) — Target on Tuesday denied a report claiming that personal identification numbers were also stolen in a data breach that affected up to 40 million credit cards. — A Reuters report Tuesday quoted …
Context & Ripple Effects
The Target breach has moved fast through its first week: Krebs on Security reported the investigation on December 18, Target confirmed up to 40 million card accounts were affected in a statement on December 19 ([[a:1201311]]), and Reuters followed with an exclusive citing sources that hackers also stole encrypted bank PINs. This piece captures the collision point: Target publicly denying the PIN claim the same day Reuters reported it.
The dispute matters because PIN data sits at the center of how much damage the breach can do — encrypted or not, its theft would change the calculus for banks deciding whether to reissue debit cards. The story traveled widely, picked up by TIME, CNNMoney, NBCNews, Fox News, BGR, and TwinCities.com within a day, and Krebs separately tied the stolen-card marketplace Rescator.la to a Ukrainian individual, keeping pressure on Target's account of events.
First-order effects
- Banks and credit unions holding the affected cards must decide immediately whether the PIN claim forces mass debit-card reissuance — a far costlier step than reissuing credit cards alone — while Target manages a communications fight over the breach's scope.
- Cardholders of the up to 40 million exposed accounts face heightened fraud exposure during peak holiday shopping, with Target simultaneously warning customers about phishing scams riding on the breach.
Second-order effects
- If the encrypted-PIN claim proves accurate, payment processors and issuing banks will push Target for forensic detail on encryption key handling, since encrypted PINs are only safe if keys were never stored alongside them — turning the dispute into a technical argument banks will want settled before spending on reissuance.
- Rival retailers now watch how a breached merchant handles contested scope: Target's public denial sets a template for disclosure strategy that competitors facing similar incidents will either copy or be judged against.
Third-order effects
- A contested back-and-forth between a retailer and wire-service sources over what was stolen points toward breach disclosure becoming a multi-week negotiation rather than a single announcement — raising the odds of legislative and regulatory interest in mandating faster, more complete retail breach notification.
- The episode feeds the broader case for chip-and-PIN adoption in US retail payments, since static magnetic-stripe data plus PIN theft is precisely the combination the card networks have cited in pushing EMV migration.
The trend: Major US retail breaches are unfolding as contested, rolling disclosures in which the retailer's statements lag and clash with security researchers' and wire services' reporting, shaping both consumer trust and the regulatory debate over payment-card security.