Hacker News Reader

Comment by chaz | Hacker News Reader

This article had a little more info: http://krebsonsecurity.com/2013/12/sources-target-investigat...

  The type of data stolen — also known as “track data” —
  allows crooks to create counterfeit cards by encoding the
  information onto any card with a magnetic stripe.

So it's not just the credit card numbers, but it's the full magstripe that was read and transmitted as-is to some central location where it was lifted. Debit cards and PINs, too, presumably.

View on HN

I'm not surprised they store something like this, when you return something you can scan your card to verify that you were the original purchaser. But why not store an irreversible hash instead of the actual magstripe?

Why do you presume that debit card PIN numbers are stored on the card? (They aren't, as far as I know - how else could you change your PIN over the phone or on the card issuer's website?)

Sorry, I should have been more clear. PINs have not been confirmed compromised in any reports I've read so far, but it's been mentioned as a possibility. If magstripes were transmitted/stored by Target to perform the authorization, then it's possible that PINs for debit cards were transmitted/stored as well.

He's not presuming the PIN is ON the card, but that the transaction was the point of compromise (i.e. you punching in your PIN and the software running a verification of if that PIN is correct).

Ah - that makes more sense.

Reply on news.ycombinator.com