Stolen Target Card Data Available To Buy Online Starting At $20 A Card

Data on credit cards and debit cards stolen during the recent unprecedented hack on Target Corp.'s (NYSE:TGT) companywide point-of-sale system are being sold online for $20 to $100 per card, according to the website that broke the original story.

KrebsonSecurity.com, a website run by former Washington Post reporter and blogger Brian Krebs, said that the cards are being sold in batches of 1 million. According to reports, as many as 40 million customers had data stolen during the sophisticated hacking theft that apparently went undiscovered for weeks.

According to Krebs,

"Prior to breaking the story of the Target breach on Wednesday, Dec. 18, I spoke with a fraud analyst at a major bank who said his team had independently confirmed that Target had been breached after buying a huge chunk of the bank’s card accounts from a well-known “card shop” — an online store advertised in cybercrime forums as a place where thieves can reliably buy stolen credit and debit cards.

There are literally hundreds of these shady stores selling stolen credit and debit cards from virtually every bank and country. But this store has earned a special reputation for selling quality “dumps,” data stolen from the magnetic stripe on the backs of credit and debit cards. Armed with that information, thieves can effectively clone the cards and use them in stores. If the dumps are from debit cards and the thieves also have access to the PINs for those cards, they can use the cloned cards at ATMs to pull cash out of the victim’s bank account.

At least two sources at major banks said they’d heard from the credit card companies, and more than a million of their cards were thought to have been compromised in the Target breach. One of those institutions noticed that one card shop in particular had recently alerted its loyal customers about a huge new batch of more than a million quality dumps that had been added to the online store. Suspecting that the advertised cache of new dumps were actually stolen in the Target breach, fraud investigators with the bank browsed this card shop’s wares and effectively bought back hundreds of the bank’s own cards.

When the bank examined the common point of purchase among all the dumps it had bought from the shady card shop, it found that all of them had been used in Target stores nationwide between Nov. 27 and Dec. 15. Subsequent buys of new cards added to that same shop returned the same result.

For more on the fallout from the Target hack, follow this link to Brian Krebs' KrebsOnSecurity.com