PIN management

Did you use a debit card at a Target store between Nov. 25 and Dec. 15? It might be a good idea to

  • Change the card s PIN number. If you have a Target Redcard, you can change your PIN online at Never use easy-to-guess PINs like 1234, or 1111. Even encrypting card data can t protect those.
  • Review your bank statements and report any suspicious charges. Some card issuers can send you an alert each time your card is used. At, activate this feature at
  • A few banks and credit unions are reissuing credit and debit cards, but most are not. Check with your bank for its recommendation.
  • Target said Friday that encrypted PINs were in fact stolen during the massive security breach at its U.S. stores, reversing its earlier claims.

    But the retailer stressed that those personal identification numbers were "strongly encrypted" and added: "We remain confident that PIN numbers are safe and secure."

    The PINs theft is an explosive issue among consumers, especially debit card holders, who fear thieves who steal card numbers and related PINs could drain their bank accounts.

    Shoppers who pay with debit cards swipe those cards at checkout, then enter a private PIN on a keypad. At Target, those PINs are instantly encrypted -- changed into a secret code -- using a system that's "highly secure," the Minneapolis-based retailer said.

    Those PINs were "fully encrypted at the keypad, remained encrypted within our system and remained encrypted when it was removed from our systems," Target said in a statement.

    Avivah Litan, a fraud analyst at information technology firm Gartner, agreed that Target's use of the Triple DES encryption system means thieves are less likely to break that code -- but it's not impossible.

    "There's no evidence that criminals broke this (Target) encryption," Litan said Friday. But, she added: "The bad guys have broken PIN encryption before. It's not unheard of."

    For more than a week, Target has said criminals stole information from up to 40 million debit and credit cards of all types used at its stores from Nov. 27 to Dec. 15. Target said the theft included credit card numbers, expiration dates and security codes embedded in the magnetic strip -- but not PINs. Online purchases were not affected.

    Now, Target says encrypted PIN information was stolen. What changed? Target didn't say, other than to cite "additional forensic work."

    Litan said Target likely knew from the start that encrypted PINs were stolen.

    "They should've just said that right away," Litan said. "The PIN data is part of the transaction stream."

    Target's changing story is another annoyance for customers who are already worried, producing plenty of grumbling online.

    "I wish you had been transparent from the beginning," shopper Jal Ferrer wrote on Target's Facebook page. "Many of your customers are loyal to your store. But a lack of transparency regarding PIN numbers is eroding that loyalty very, very fast."

    Target is urging shoppers to remain calm, check their statements for suspicious charges and change their debit card PINs.

    "The most important thing for our guests to know is that their debit card accounts have not been compromised due to the encrypted PIN numbers being taken," Target spokeswoman Molly Snyder said in a statement.

    In its statement, Target made the case that it "does not have access to, nor does it store, the encryption key within our system. ... What this means is that the 'key' necessary to decrypt that data has never existed within Target's system and could not have been taken during this incident."

    Outside security experts, however, have noted that there's still some heightened risk to debit card holders.

    If thieves were sophisticated enough to steal up to 40 million accounts without Target's notice, experts warned, they also might be able to crack the encryption codes -- or to have stolen those codes in a separate breach.

    Shane Shook, chief knowledge officer for the cyber security firm Cylance, said he doesn't buy the argument that encrypted PINs are safe, even those encrypted with Triple DES.

    "It's certainly safer than an unencrypted PIN, but there is still a risk," Shook said. "Fundamentally, PIN codes are only four digits, so there are only 10,000 possible combinations."

    Even if the thieves are unable to decrypt the PINs, they will likely still be able to extract some value from them by simply trying the most common codes, such as 1111 and 1234.

    Shook cited a study suggesting that 11 percent of all PINs are 1234.

    Litan, the Gartner expert, also pointed out that even if PINs are used in fraudulent transactions, it doesn't necessarily mean the encryption was broken. Thieves have found ways to trick banks into changing PINs for stolen cards.

    Those possibilities seem to be one of the reasons that a handful of financial institutions clamped limits on their debit card holders, thereby limiting potential losses.

    Following the breach, banking giant JPMorgan Chase initially restricted cash advances to $100 a day and purchases to $300 a day. The bank said Tuesday that it was raising those limits to $250 a day in cash advances and $1,000 a day in purchases.

    On Wall Street, Target shares Friday fell 33 cents, or 0.5 percent, to close at $62.15.

    Tom Webb can be reached at 651-228-5428. Follow him at Nick Woltman can be reached at 651-228-5189. Follow him at