Target confirms encrypted debit PIN data was stolen during hack
Target has confirmed that encrypted debit card PIN data was stolen as part of the massive hack carried out against the retailer between late November and early December. The company previously admitted that card numbers …
Context & Ripple Effects
The story has moved fast through the holidays: KrebsOnSecurity first reported Target investigating a breach on December 18, and the company confirmed 40 million affected accounts the next day, with stolen cards already selling in underground batches per Krebs. On December 25 Reuters reported that encrypted bank PINs were among the loot — a claim Target publicly denied that same day. Two days later, that denial is reversed: Target now confirms encrypted debit PIN data was taken alongside the card numbers it had already admitted losing.
The reversal matters because the PIN data was encrypted, but encryption only holds if the decryption keys stayed secure — which is exactly what banks and card networks now have to assess before deciding whether reissued debit cards are enough or whether PIN infrastructure itself is at risk.
First-order effects
- Banks and debit issuers face a costlier reissuance decision: with encrypted PINs confirmed stolen, replacing card numbers alone may not neutralize the risk if the encryption keys are ever recovered.
- Target's disclosure posture takes a credibility hit after denying the PIN theft on December 25 and confirming it on December 27, raising the bar for how regulators, payment partners, and customers weigh its future statements.
Second-order effects
- Card networks and issuers gain fresh ammunition in the long-running push to move U.S. retailers off magnetic-stripe authentication toward chip-based verification, since the breach exploited exactly the data model chips were designed to protect.
- Underground card markets, where stolen Target cards were already selling for $20 to over $100 each per KrebsOnSecurity, could see prices adjust depending on whether buyers judge the PIN data usable.
Third-order effects
- If major breaches keep exposing magstripe-era card data at this scale, the structural question shifts from any single retailer's security to how quickly the U.S. payments ecosystem mandates chip-and-PIN-equivalent authentication at point of sale.
- Retailers broadly face a disclosure-credibility problem: Target's two-day flip from denial to confirmation illustrates why partial breach statements invite follow-on reporting that erodes trust faster than fuller initial disclosure would.
The trend: High-volume U.S. retail breaches are accelerating the industry's migration away from magnetic-strip card authentication toward chip-based verification, with each large theft strengthening issuers' case.