Target Customers PIN Data Not Compromised
KEILAR: New developments in that massive security breach that compromised the credit and debit card information of 40 million, that's right, 40 million Target customers. Today, the company is giving new details about the investigation and CNN business correspondent Zain Asher is here to catch us up on that. What's going on, Zain?</s>ZAIN ASHER, CNN BUSINESS CORRESPONDENT: Hi, Brianna. Well, there was a Reuters report that the hackers who compromised those 40 million debit and credit cards may have actually gotten access to people's PIN numbers as well. Now Target for their part has come out denying this. They sent us a statement today saying, and I'm quoting here, "There is no evidence that unencrypted PIN data was compromised." Now we have no idea at this point. It's obviously very early in the investigation. We're not sure what's true and what's not true. But I will say that if it is true, if people's PIN numbers were compromised as well, it does open a whole new can of worms, because it means that these hackers can actually go to the ATM and withdraw money directly from people's bank accounts. It also means they can check your balance as well and figure out how much money is at their disposal, too. So, obviously, Target coming out once again denying this, but I will say that if you did shop at Target between the end of November and mid-December, it is crucial that you be safe and you check your statements with a fine tooth comb. I can't emphasize that enough -- Brianna.</s>KEILAR: Yes, that's right. It's so scary, the idea that someone would have access to your bank account. I mean, that's so much more scary --</s>ASHER: I know. It's crazy.</s>KEILAR: -- than a compromised credit card, which is, you know, obviously a major concern of us.</s>ASHER: Right.</s>KEILAR: Now a lot of people may not realize that these magnetic strips that are in these cards are actually old technology. What's the new technology and when might retailers upgrade?</s>ASHER: Right. So the new technology, if you want to call it that, is what they use in Europe, which is the chip and PIN system. It's very different from the magnetic strip because it means there's an actual chip on your card where all your data is stored. It's not transmitted so for the most part, if a hacker wants to gain access to your account, they actually need your physical card to do it, and they need your PIN as well. So, in Europe, you are less likely to have these mass data breaches that you have in the U.S. so American banks are very good at detecting fraud but European banks are a lot better at preventing it. But the problem is, their system is a lot more expensive than our system in the U.S. -- Brianna.</s>KEILAR: That's right. It's the cha-ching. All right, Zain, thank you so much for breaking that down for us. We appreciate it. Let's get more now with Catherine Lotrionte, she is the director for -- I should say of the Institute for Law, Science and Global Security and a visiting professor at Georgetown University. And not only that, Catherine, you're also a Target shopper with a Target debit card which I didn't even know existed. But in light of that, and what you know about security, what are you going to do moving forward?</s>CATHERINE LOTRIONTE, INSTITUTE FOR LAW, SCIENCE AND GLOBAL SECURITY: Well, as a consumer, and someone that shops pretty regularly at Target, of course, I'm very concerned. But the larger issue is that the United States, we as a nation, haven't done what we need to do to protect our data, and the retailers, the companies themselves have not deterred the criminals. We've made it quite easy for the cyber criminals to get access to our personal data.</s>KEILAR: And right now there's a lot of people like yourself who are wondering oh, my goodness, is my PIN number out there floating somewhere, and even if everything looks OK in my bank account, should I still be concerned? Is it too late for those people who have seen their PIN information out there, what can they do?</s>LOTRIONTE: I think they should first contact Target. And the lack of information I think we need customers and consumers need a lot more information from Target, from the CEO. They say that 40 million customers' information has been compromised. They said that they have notified customers or are notifying customers by e-mail. I don't know how they get everybody's e-mail. I haven't gotten an e-mail from them.</s>KEILAR: And they have yours.</s>LOTRIONTE: Yes.</s>KEILAR: Whereas other people, they may not have their e-mail.</s>LOTRIONTE: That's right. With those that are using regular credit cards don't necessarily have e-mail contact. So they -- I mean, I am wondering where the CEO is, I'm giving out this information. And more importantly, what policies did they have in place to secure the data, were they followed and if they weren't followed, that's where people like Senator Blumenthal has called upon the commissioner of the FTC to not only investigate but to hold Target liable for any of the costs. If they were found to not take reasonable steps to protect it.</s>KEILAR: OK. So let's talk about what Target is saying. I think I'm going to know the answer to your question about whether we should be assured by this. But Target says, "To date there is no evidence that unencrypted PIN data has been compromised. In addition based on our communications with financial institutions they have also seen no indications that any PIN data was compromised." Should we feel reassured by that?</s>LOTRIONTE: I don't.</s>KEILAR: You don't.</s>LOTRIONTE: And I would not encourage customers to be assured that nothing, including their PIN numbers, have not been compromised. Then the question for Target is, they could -- why unencrypted? Why aren't they taking steps by encrypting data? The answer is because it costs money. But to protect our data, what the retail organizations in the country need to take seriously is it might cost them more money in order to protect the consumers' data.</s>KEILAR: But you see the difference when you look at Europe. You're saying the retailers are responsible and the government is also responsible. Right? So that's what you're saying. Is it -- in Europe, is it that governments are saying OK, retailers, this is the mark you need to meet in terms of security, and the U.S. government doesn't do that?</s>LOTRIONTE: So there's three groups of entities or groups of people that point fingers at each other expecting the other to carry the costs. The credit card and debit card companies, and they are accused of not having secure cards. You talked about the magnetic strips. The Europeans have more secure cards but it costs money to implement those new cards. The banks also are sometimes accused but also call upon the retailers to have more secure systems. And then there's the retailers themselves, the companies clearly -- I mean, where I come down is more needs to be done by the companies. The individual companies in retail, that's the face to the customers. Right? We're going in to Target, we're giving Target our trust. Not really thinking about our bank, but we're hoping that Target and believe at least what Target says is that they're protecting our data. So that company, all the companies, need and they're not doing enough.</s>KEILAR: Sure.</s>LOTRIONTE: That's the reality. They're just not.</s>KEILAR: And -- so you're calling on the retailers to do more? I'm sure this isn't the last of this kind of thing that we will hear of. So we'll see if maybe they do move in that direction. Catherine Lotrionte, thanks for being with us. Appreciate it.</s>LOTRIONTE: Thank you.</s>KEILAR: Now, just ahead, how did a man walk on to two runways at a major U.S. airport? We have details of the investigation and the unusual clothes that he was wearing. And stuck in frozen, 74 people on a ship at the bottom of the world. We will go live to Antarctica coming up in our next hour.