Hacker News Reader

Comment by AmVess | Hacker News Reader

From the article:

"Q: How did the breach occur?

A: Target isn't saying how it happened. Industry experts note that companies such as Target spend millions of dollars each year on credit card security, making a theft of this magnitude particularly alarming."

The article starts out by stating, "The stolen data includes customer names, credit and debit card numbers, card expiration dates and the three-digit security codes located on the backs of cards."

I guess, then, that the 'millions' spent budget didn't include basic compliance measures. Next time, Target might as well take out an ad in the NYT with all this info, though....It'd be less effective than what's already happened to them.

Idgits.

View on HN

From Target's notification email:

> Is the CVV code the same as the three digit code on the back of my card? > No, the CVV code is not the same as the security code on the back of your card. As of now we have no indication that the three digit code on the back of the card has been impacted.

I am under the impression that:

1. CVV is exactly the same as the security code

2. Merchants are never allowed to store this code

There are two CVV codes, CVV1 and CVV2. CVV1 is on the magstripe but not printed on the card. CVV2 is printed on the card but not on the magstripe (it's the three digit code printed on the back).

It sounds like Target was storing the CVV1 code (which they shouldn't have been), but there's no way they could have the CVV2 code, since the POS computer never sees it.

This means that the stolen data could be used to make a cloned card for physical purchases, but couldn't be used for an online purchase (unless the online store doesn't ask for the CVV2).

See http://en.wikipedia.org/wiki/Card_Verification_Value

If the POS terminals were compromised, attackers could have retrieved CCV1 numbers at the point of reading the card. In other words, it's still possible Target complied with the PCI requirement of not storing CCV numbers. But since nobody knows how the attack happened, it's all just speculation.

At target, you insert your card into a device that fully captures it. It's quite possible they could photograph both sides/OCR to find your CVV2.

(AFAIK they don't, but there certainly isn't "no way" they could have it.)

Not at all Targets.

I worked at several stores (up through 2008), and still shop there.

I have never seen a credit card machine at the stores I have been in contacted that fully captures a credit/debit card.

Reply on news.ycombinator.com