How could hackers steal 40 million credit card numbers from Target?

Today, Target confirmed that hackers breached the retailer's system, stealing the information for tens of millions of credit cards — both Target cards, and those from other issuers.

"Approximately 40 million credit and debit card accounts may have been impacted," the retailer said in a statement on its website. The breach started the day before Thanksgiving, and continued through December 15, right in the thick of the holiday rush.

This means, at least theoretically, that hackers could make a whole bunch of counterfeit credit and debit cards by encoding the stolen "track data" on any magnetic stripe, says Krebs on Security, which broke the story. Depending on whether the thieves also nabbed PINs or other data, they may be able to use the cards to make purchases and even withdraw money from ATMs.

Subscribe to The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

Sign up for The Week's Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up

If 40 million credit and debit cards sounds like a lot, it is; but it's no record breaker. In 2009, cyber-criminals hacked Heartland Payment Systems, a credit card processor, and stole data for 130 million cards. Here's The Wall Street Journal on the modern history of mass credit card theft:

Okay. But how does someone collect information for 40 million — or 160 million! — credit cards without being detected? In the Target hack case, it was not by infiltrating Target.com from the safety of the hackers' dark basements, it seems. This hack appears to affect those shopping at nearly every brick-and-mortar Target location throughout the nation, without impacting those online.

This means hackers had to hit the point-of-sale systems — the hardware and software the retailer uses at the checkout line to process credit cards and record sales. "As shoppers swiped or punched in their numbers on the checkout keypad, the hackers copied every single number," reports Slate.

Of course, this doesn't mean the baddies hoofed it to over 1,800 Target locations in the U.S. and Canada. Rather, according to security experts, someone inside the company would have had to insert the malware on a Target machine, says The New York Times.

The other possibility is that a hacker "persuaded an unsuspecting employee to click on a malicious link that downloaded malware that gives cyber criminals a foothold into a company's point-of-sale systems," says the Times.

In which case, the moral is don't click on emailed links from strangers. Especially not at work.