40 2 6 LINKEDINCOMMENTMORE

CLEVELAND -- So you shopped at Target between Nov. 27 and Dec.15, now what should you do?

Like one of every eight Americans, you're at risk.

Experts like Ken Stasiak's Cleveland information security company Secure State say you're likely to notice even small charges on your statement that show someone is testing out your card or targeted email scams.

"That could be a malicious attack now focused on the consumers that got breached," said Stasiak. "Look at your charges on your card and specifically for your debit card, make sure you change your PIN."

If you notice activity call your bank or credit card company and Target. They'll report the activity to your credit card companies and call Target at (866) 852-8680.

You could cancel your card and request a new number, but Stasiak says it's not necessary. But it is necessary to continue to monitor your account for the next six months for fraud.

To protect your information in the future, what's the safest place to shop: online or in the stores?

"Up to this point you would say, you're safer in the store. But in reality, they're kind of a wash," said Stasiak. "Target and the information they've stored, they have full card swipes, they have everything, the security code, all that stuff, and that is really key for an attacker. Online most of that stuff is not stored. So it really is a trade off on what is secure."

Stasiak says Target is going to lock down it's card processing and information. But this won't be the last breach.

"2014, you're definitely going to see more breaches coming out and more credit cards being stolen."

Here are some more answers provided by the Associated Press to the most common questions about the theft:

Q: I shopped at Target during that time. What should I do?

A: Check your credit card statements carefully. If you see suspicious charges, report the activity to your credit card companies and call Target at 866-852-8680. You can report cases of identity theft to law enforcement or the Federal Trade Commission.

You can get more information about identity theft on the FTC's webs

ite at www.consumer.gov/idtheft, or by calling the FTC, at (877) IDTHEFT (438-4338).

Q: How did the breach occur?

A: Target isn't saying how it happened. Industry experts note that companies such as Target spend millions of dollars each year on credit card security, making a theft of this magnitude particularly alarming.

Experts disagree about how the breach might have happened.

Avivah Litan, a security analyst with Gartner Research, says given all the security, she believes the breach may have been an inside job.

But thefts of this size are too big to be the work of company employees, says Ken Stasiak, founder and CEO of Secure State, a Cleveland-based information security firm that investigates data breaches like this one. Stasiak says that such breaches are generally perpetrated by organized crime or an overseas, state-sponsored hacker group.

Stasiak's theory is that the hackers were able to breach Target's main information hub and then wrote a code that gave them access to the company's point of sale system and all of its cash registers. That access allowed the hackers to capture the data from shoppers' cards as they were swiped.

James Lyne, global head of security research for the computer security firm Sophos, says something clearly went wrong with Target's security measures.

"Forty million cards stolen really shows a substantial security failure," he says. "This shouldn't have happened."

Q: Who pays if there are fraudulent charges on my account?

A: The good news is in most cases consumers aren't on the hook for fraudulent charges.

Credit card companies are often able to flag the charges before they go through and shutdown your card. If that doesn't happen, the card issuer will generally strip charges you claim are fraudulent off your card immediately.

And since the fraud has been tied to Target, it'll be the retailer that ultimately compensates the banks and credit card companies.

Q: How can I protect myself?

A: Like they say, cash is king. You can only lose what you're carrying, though admittedly many people may not feel safe walking around with a wad of bills in their pocket.

As stated before, credit card companies don't hold consumers liable for charges they don't make. Usually the worst thing consumers have to deal with is the hassle of getting a new credit card.

And the paper trail generated through credit card transactions can often make it easier do things such as return items you've purchased, or keep track of work-related expenses.

It's worth noting that while debit cards offer many of the same perks as credit cards, without the worry that you'll spend more than what's in your bank account, they often don't come with the same kind fraud protections.

As a result, those card holders may have a tougher time getting their money back if their number is stolen.

Q: How much is this going to cost Target?

A: It's too soon to tell. In addition to the fraud-related losses, banks may start charging Target a higher merchant discount rate, which is the amount retailers pay banks for providing debit and credit card services. While the percentage difference may be tiny, it could result in steep costs given the volume of transactions Target does, Litan says.

Litan added that the company could also face class action lawsuits from consumers, though most of them will be meritless, and fines from federal agencies. When combined, the costs of the breach could be so steep that they actually prompt Target to raise prices, she says.

"The real winner in this is Wal-Mart," she says.

Q: Can the bad guys be caught?

A: Stasiak says that given the sophistication of this attack, there's only about a 5 percent chance that the perpetrators will eventually be caught and prosecuted.

He notes that in cases like this, it's hard to determine where the attack originated and given the large mass of information involved it's not going to be found housed on someone's home computer.

Q: How can future breaches be prevented?

A: Litan says an easy way to prevent fraud would be to eliminate the use of easily cloned magnetic strip cards and upgrade to the kind of microchip technology used in most other parts of the world.

But she says banks have pushed back against the idea, because the microchip cards cost significantly more than the magnetic strip version and changing over all the country's ATMs could drive the total costs into the billions of dollars.

Lyne says it's unclear if the use of microchip cards would have prevented the Target breach, since it's unclear how it happened, but that it certainly wouldn't hurt.

Q: Why is the Secret Service investigating?

A: While it's most famous for protecting the president, the Secret Service also is responsible for protecting the nation's financial infrastructure and payment systems. As a result, it has broad jurisdiction over a wide variety of financial crimes. It isn't uncommon for the agency to investigate major thefts involving credit card information.

40 2 6 LINKEDINCOMMENTMORE
Read or Share this story: http://on.wkyc.com/1bU2Fxj