Target's acknowledgement Friday that personal data of 70 million people, not 40 million as previously thought, may have been exposed to hackers in a recent data breach raises new questions about the incident and how it could affect victims.
Target today also said that an ongoing investigation of the data breach has revealed that "guest information" such as names, mailing addresses, phone numbers, and email addresses of customers may have been accessed by the same thieves who hacked into its systems last month.
Much of the exposed data is "partial in nature," the company said in a statement this morning. In cases where a customer email address is available, Target said it would attempt to contact affected individuals.
"We know that it is frustrating for our guests to learn that this information was taken and we are sorry they are having to endure this," said Target chairman and CEO Gregg Steinhafel in the statement.
Target in mid-December revealed that hackers had broke into its systems between Nov. 27 and Dec. 15 and accessed data on up to 40 million debit and credit cards. At the time, Target said that hackers gained access to cardholder names, credit or debit card numbers, card expiration dates and CVV security codes.
Target now says that its subsequent investigation found that data from 30 million more cards was exposed. "This theft is not a new breach, but was uncovered as part of the ongoing investigation," the company said.
The update shows that the breach exposed data on about one third of the adult population of the United States, noted James Huguelet, and independent security consultant who specializes in retail security. "It now implies that consumers who shopped at Target outside of the approximately one month the breach was active have now become potentially affected by this breach," he said. Target's statement suggests that in some cases, only an individual's e-mail address might have been compromised, while in others, the mailing address might have been exposed. Huguelet said the "partial" exposure implies "that multiple systems containing different types of information were compromised [though] that's purely speculative at this point."
Hackers using the stolen information can now target victims with highly sophisticated spear-phishing attacks Huguelet warned.
"I can see a criminal being able to create a very effective attack with each e-mail sent having been customized to include the target's name, address, and phone number. This could very well lead to a massive wave of identity theft across the United States," he said.
Huguelet suggested that all Target customers accept the retailer's offer to provide free credit monitoring, though he added, "I'm surprised that Target is not making this available immediately." Attacks could already be underway and the credit monitoring may come too late for some victims, he said.
Sign up for Computerworld eNewsletters.