Hacker News Reader

Comment by carsonreinke | Hacker News Reader

I still do not understand why they would have to store the credit card instead of just storing an authorization and transaction number.

View on HN

This article had a little more info: http://krebsonsecurity.com/2013/12/sources-target-investigat...

  The type of data stolen — also known as “track data” —
  allows crooks to create counterfeit cards by encoding the
  information onto any card with a magnetic stripe.

So it's not just the credit card numbers, but it's the full magstripe that was read and transmitted as-is to some central location where it was lifted. Debit cards and PINs, too, presumably.

Why do you presume that debit card PIN numbers are stored on the card? (They aren't, as far as I know - how else could you change your PIN over the phone or on the card issuer's website?)

Sorry, I should have been more clear. PINs have not been confirmed compromised in any reports I've read so far, but it's been mentioned as a possibility. If magstripes were transmitted/stored by Target to perform the authorization, then it's possible that PINs for debit cards were transmitted/stored as well.

He's not presuming the PIN is ON the card, but that the transaction was the point of compromise (i.e. you punching in your PIN and the software running a verification of if that PIN is correct).

Ah - that makes more sense.

I'm not surprised they store something like this, when you return something you can scan your card to verify that you were the original purchaser. But why not store an irreversible hash instead of the actual magstripe?

I got the impression that the hack was more of an intricate skimmer that exploited the POS system's network - basically intercepting credit card track data and PIN numbers between the POS terminals and the processor.

It seems likely that their card authorization system was compromised.

Reply on news.ycombinator.com