Target says hackers took encrypted PIN data but can't crack it

1/5

In 2006, Abercrombie & Fitch Chief Executive Michael S. Jeffries gave a magazine interview in which he said the brand is “exclusionary,” focusing on “the cool kids...the attractive all-American kid.” “A lot of people don’t belong [in our clothes], and they can’t belong,” he said. In May, the interview resurfaced and went viral, with consumers protesting Abercrombie’s lack of XL and XXL women’s sizes. After a week of shopper complaints -- a Change.org petition demanding an apology has garnered more than 65,000 signatures; one man began handing out Abercrombie clothing to homeless Skid Row residents -- Jeffries spoke out. He emphasized that his brand is an “aspirational” one but that it is “completely opposed to any discrimination, bullying, derogatory characterizations or other anti-social behavior based on race, gender, body type or other individual characteristics.” “I sincerely regret that my choice of words was interpreted in a manner that has caused offense,” he said. Still no plans to offer larger women’s clothing, though. (Lawrence K. Ho / Los Angeles Times)

2/5

More than 1,100 workers died April 24 when the eight-story Rana Plaza in Bangladesh collapsed, reportedly after workers complained of cracks in the building and were ordered by managers to remain inside. The disaster comes amid a slew of other apparel manufacturing tragedies, including a November fire that killed 110 people and a more recent inferno that took eight lives -- both in Bangladesh. The events have intensified protests over poor working conditions, including pay of 21 cents an hour for Bangladeshi laborers. The government has promised reforms, including allowing workers to form labor unions. Activists have ramped up pressure on garment companies and consumers to ease up their relentless cycle of consumption and reevaluate their supply chains. Wal-Mart and J.C. Penney -- which both carried goods supplied by the destroyed factory -- have pledged more vigilance. Neither, however, signed the legally binding Accord on Fire and Building Safety in Bangladesh, which includes standards now backed by H&M, Abercrombie & Fitch and Calvin Klein parent PVH. (Munir Uz Zaman / AFP/Getty Images)

3/5

Target shoppers flew into a fury in April after a shopper tweeted about the retailer’s “plus-size kimono maxi-dress,” offered in a shade the company referred to as “manatee gray.” The reference to the hulking aquatic animals, occasionally known as “sea cows,” was especially striking considering that the same garment in smaller sizes were dubbed by Target as “dark heather gray.” Target, which also offers home goods and men’s T-shirts in the so-called “manatee” hue, pulled the offending label from the dresses and issued a mea culpa soon after the outrage erupted. (Mike Aguilera / AP)

4/5

In the space of two years, discount department chain J.C. Penney’s reputation went from stodgy to sacked. Ron Johnson was brought in as chief executive from Apple in a flurry of fanfare in November 2011. He left a year and half later under a cloud of discontent, with the company’s stock price halved, four straight quarters of double digit revenue plunges and a workforce lightened by tens of thousands of layoffs. In the first quarter of earnings reported after his departure, revenue plunged 16% as the company continues to struggle with the aftershocks of Johnson’s poorly received turnaround plan. The Plano, Texas, retailer is now reassessing its situation, hiring back Johnson’s predecessor Myron Ullman as chief executive and returning its rotation of sales. The company even copped to “mistakes” in a video. (Mary Altaffer / AP)

5/5

Wal-Mart Stores Inc., the largest retailer in the world, is still dealing with fallout from a bribery scandal uncovered last year. A group of investors, including the California State Teachers’ Retirement System, is suing the company over accusations that top executives knew about bribes to Mexican officials but tried to limit investigations into the wrongdoing. The bribes -- meant to butter up real estate power players -- and the alleged cover-up were first reported by the New York Times. Prosecutors from the U.S. and Mexico said last year that they are looking into the claims. Plaintiffs in the investor lawsuit against Wal-Mart say that officials at the Bentonville, Ark., mega-retailer are still concealing relevant documents in the case, allegations that the company disputes. But in May, a Delaware Chancery Court judge ruled that executives must turn over more internal documents to help suss out the extent of their knowledge of the bribery scheme. (Sarah Meghan Lee / For The Times)

By Tiffany Hsu

Dec. 27, 2013 10:39 AM PT

Target Corp. said the cyber-crooks who hacked their way to approximately 40 million customer credit and debit card accounts during the holiday season accessed “strongly encrypted” PIN information.

Still, the retailer said Friday that it remains “confident that PIN numbers are safe and secure.”

The PIN data is encrypted as it’s entered by a customer at a keypad at checkout, protected with what’s known as Triple DES encryption, according to Target.

The PIN information stays encrypted within Target’s system and “remained encrypted when it was removed,” the Minneapolis-based company said.

The code can only be cracked when the data is received by Target’s external, independent payment processor, according to the retailer.

“What this means is that the ‘key’ necessary to decrypt that data has never existed within Target’s system and could not have been taken during this incident,” the company said Friday.

The retailer didn’t address the possibility that hackers sophisticated enough to execute a break-in during prime shopping season -- lasting from the crazed Black Friday weekend through Dec. 15 -- might be able to outwit the encryption defense.

“The most important thing for our guests to know is that their debit card accounts have not been compromised due to the encrypted PIN numbers being taken,” Target said.

The company said its investigation into the incident is “still in the early stages” and “is continuing and ongoing.”

Phony credit cards made with the stolen information are already being sold on the black market, according to some reports. A senator from Connecticut is calling for a probe into Target’s security infrastructure; several state attorneys general have asked for more information on the hack.

After the breach, Target’s perception among consumers hit its lowest point in more than six years, according to sentiment tracker YouGov BrandIndex.

ALSO:

Target breach: Senator calls for probe, shopper perception sinks

Stolen Target credit cards available on black markets everywhere

Target CEO promises free credit monitoring, 10% discount after breach