Target: Encrypted PIN Data Among Hacked Information
Following the theft of credit card and debit card data from as many as 40 million accounts first announced on Dec. 19, in addition to later reports that the stolen data included customer PIN numbers, Targetconfirmed today that "strongly encrypted PIN data was removed."
However, Target added in its statement that customer PIN data remains safe, due to the nature of the encryption. Triple DES encryption is derived from the 64-bit Data Encryption Standard (DES) algorithm, though it uses three 64-bit strings, for a total of 192 bits, to increase data security.
Accessing Target customers' stolen PIN numbers requires decrypting the data using a "key" which Target asserts could not have been hacked because:
Target does not have access to nor does it store the encryption key within our system. The PIN information is encrypted within Target's systems and can only be decrypted when it is received by our external, independent payment processor. What this means is that the "key" necessary to decrypt that data has never existed within Target's system and could not have been taken during this incident.
Target added it is "still in the early stages of this criminal and forensic investigation." A recent press release also noted that Target is working with the Secret Service and U.S. Department of Justice, and will host a follow-up call on Jan. 6 with attorneys general from around the country.
Gartner security analyst Avivah Litan said Friday that the PINs for the affected cards are not safe and people "should change them at this point." Litan said that while she has no information about the encrypted PIN information in Target's case, such data has been decrypted before.
In addition to the encrypted PINs, customer names, credit and debit card numbers, card expiration dates and the embedded code on the magnetic strip on back of the cards were stolen from about 40 million credit and debit cards used at Target stores between Nov. 27 and Dec. 15.
-- Material from The Associated Press was used in this report.
The article Target: Encrypted PIN Data Among Hacked Information originally appeared on Fool.com.
Fool contributor Tim Brugger has no position in any stocks mentioned. The Motley Fool has no position in any of the stocks mentioned. Try any of our Foolish newsletter services free for 30 days. We Fools may not all hold the same opinions, but we all believe that considering a diverse range of insights makes us better investors. The Motley Fool has a disclosure policy.
Copyright © 1995 - 2013 The Motley Fool, LLC. All rights reserved. The Motley Fool has a disclosure policy.
