Target Confirms Point-of-Sale Malware Was Used in Attack
According to Target Chairman and CEO Gregg Steinhafel, point-of-sale (POS) malware was used in the recent attack that compromised millions of credit and debit card account numbers of customers across the country.
Context & Ripple Effects
The disclosure has escalated in three steps since mid-December: Target first confirmed up to 40 million card accounts were hit during the holiday shopping season [[a:1201311]], then admitted encrypted debit PIN data was among what was stolen [[a:1201468]], and on January 10 widened the scope again to up to 70 million customers whose personal information was taken.
What changes with this report is attribution of method: CEO Gregg Steinhafel has moved the explanation from 'cards were compromised' to 'malware sat on point-of-sale terminals,' which reframes the breach from a data-theft incident into an intrusion inside Target's checkout infrastructure itself. The story travelled unusually wide on the day — Reuters (with an exclusive citing sources that other well-known U.S. retailers were also victims), CNBC, CNET, Re/code, NBC and others all picked it up — signaling that the industry is treating this as a template, not a one-off.
First-order effects
- Card-issuing banks and credit unions bear the immediate cost of reissuing millions of compromised cards and absorbing fraudulent charges, while Target's disclosure cadence — 40 million cards, then PINs, then 70 million customer records, now POS malware — keeps the incident in front of shoppers weeks after the holiday season ended.
- Steinhafel's confirmation puts Target's own checkout hardware under scrutiny, forcing the company to explain how malicious code reached its registers undetected while the breach was live between late November and early December.
Second-order effects
- Other large retailers face pressure to audit their own point-of-sale environments for similar malware, a concern sharpened by the same-day Reuters report citing sources that additional well-known U.S. retailers had been victims of cyber attacks.
Third-order effects
- If magstripe-based card authentication stays the standard, every retailer running legacy POS terminals remains exposed to the same class of attack, shifting the debate toward stronger card-security technology and potentially toward regulators or the card networks mandating it.
The trend: Payment-card breaches are moving from stolen databases to malware implanted inside retail checkout systems, turning POS terminal security into an industry-wide liability rather than any single retailer's problem.