Target reveals personal information for 70 million people stolen
Target's data breach is a bit broader than once believed. — The major retailer on Friday announced that up to 70 million customers have had their personal information stolen as part of the company's payment card data breach.
Context & Ripple Effects
The breach arc has moved fast: Krebs on Security first reported Target investigating a hack on December 18, followed by the retailer's confirmation of 40 million compromised accounts on December 19. Target initially denied that debit PINs were taken, then on December 27 reversed course and confirmed encrypted PIN data was among the stolen material.
Today's disclosure nearly doubles the scope again — up to 70 million people had personal information such as names and contact details lifted alongside the card data. The story has traveled unusually far for a corporate breach announcement, with pickups across Reuters, the Wall Street Journal, the Guardian, Re/code and GeekWire all landing the same day.
First-order effects
- Up to 70 million Target customers now face exposure of personal information beyond card numbers, expanding the identity-theft risk well past the payment-card population disclosed in December.
- Target's disclosure record takes a direct hit: the affected total has been revised upward twice in three weeks, and the company's earlier denial on PIN theft was contradicted by its own later confirmation of encrypted PIN data being stolen.
Second-order effects
- With stolen cards already selling in underground markets in batches of one million at $20 to over $100 per card per KrebsOnSecurity, banks and card issuers bear mounting reissuance and fraud costs as more compromised cards surface.
- Rival retailers now face consumer and card-network pressure to demonstrate their own point-of-sale security, accelerating interest in more secure card technologies ahead of any industry-wide migration.
Third-order effects
- If the pattern holds — breach scope growing with each successive disclosure — regulators and legislators gain fresh evidence for mandating faster, fuller breach notification and stronger retail payment security standards.
- The economics visible here, where card data monetizes quickly on underground markets while remediation costs land on Target, banks and shoppers, push the US retail industry toward chip-based cards as the structural fix.
The trend: Retail payment breaches are escalating from isolated card-number thefts into mass harvesting of customer identities, forcing the industry toward chip-based cards and stricter disclosure norms.