Hacker News Reader

I would expect the credit card companies would require that they not store the entire card swipe data (or the PIN for that matter).

View on HN

That is what I thought as well, but details on the Target hack suggests they managed to get hold of the cards' entire track data (I'm on my phone so can't link to the article directly, but it's on the same website as OP's link) I'm guessing NM has the same data policy.

I'm not aware of the details, but they might have managed to store the track data because they intercepted it in transit, not because Target was storing it somewhere.

I thought the theory was that the target hack was targeted at POS card-readers, not recovering numbers after the fact from a database.

It was.

But in order to pull it off on the scale they did, the bad guys must have broken into Target's corporate network. Apparently, the level of access they achieved allowed them to raid the marketing database as well as to hack large numbers of POS terminals to leak the card swipe data.

The marketing database, BTW, contained name and contact information, but not credit card details. The bad guys might find it useful for phishing attacks.

Reply on news.ycombinator.com