Inside Target, CEO Gregg Steinhafel Struggles to Contain Giant Cybertheft
How Target Is Working to Manage Crisis After Theft of Credit and Debit Card Numbers From Millions of Customers — When hackers broke into the database of department store Target, it affected an estimated 100 million customers.
Context & Ripple Effects
This story caps a two-month escalation arc. What began as an investigation reported by Krebs on Security in December 2013 became a widening disclosure: first the theft of personal information for 70 million people in January, then confirmation by early February that as many as 110 million customers were caught up in a breach traced to network credentials stolen from a third-party vendor.
Two threads make this crisis management story rather than just another breach report. One is history: Wired documented in January that Target had already been hacked hard in 2005 and failed to prevent a repeat. The other is remediation already underway — Target said on February 4 it was developing security-focused credit cards. With stolen card numbers confirmed transmitted to a server in Russia, the Wall Street Journal turns its lens on CEO Gregg Steinhafel himself.
First-order effects
- Steinhafel now owns a crisis spanning an estimated 100 million customers' credit and debit card numbers, with disclosure still expanding two months after the initial investigation — every new number forces another round of customer communication and bank coordination.
- Issuing banks bear immediate reissuance costs and fraud exposure for compromised Target cards, keeping the retailer's name in front of their customers daily.
Second-order effects
- Target's move toward security-focused credit cards puts pressure on other major US retailers, whose magnetic-stripe-only infrastructure now looks like the weak point rather than an accepted norm.
- The confirmed third-party-vendor entry path pushes every large retailer to re-examine contractor network credentials — vendors become audit targets across the sector.
Third-order effects
- If the pattern holds, breach disclosure becomes a rolling, months-long process rather than a single event, forcing regulators and issuers to rethink how liability for reissuance and fraud is allocated between breached retailers and card networks.
- A second major breach at the same retailer inside a decade strengthens the case for mandated chip-based card security and stricter vendor access controls as structural fixes rather than optional investments.
The trend: US retail is being pushed from magnetic-stripe convenience toward chip-based card security and hardened vendor access controls, with each mega-breach raising the political cost of delay.