Target, which has almost 1,800 stores in the U.S. and 124 in Canada, said it immediately told authorities and financial institutions once it became aware of the breach on Dec. 15. The company is teaming with a third-party forensics firm to investigate and prevent future problems.
The credit card breach poses a serious problem and threatens to scare away shoppers who worry about the safety of their personal data.
Target's stock dropped more than 2 percent, or $1.40, to $62.15 on Thursday.
"This is close to the worst time to have it happen," said Jeremy Robinson-Leon, a principal at Group Gordon, a corporate and crisis public relations firm. "If I am a Target customer, I think I would be much more likely to go to a competitor over the next few days, rather than risk the potential to have my information be compromised."
Target advised customers Thursday to check their statements carefully. Those who see suspicious charges should report them to their credit card companies and call Target at 866-852-8680. Cases of identity theft can also be reported to law enforcement or the Federal Trade Commission.
"Target's first priority is preserving the trust of our guests, and we have moved swiftly to address this issue, so guests can shop with confidence," Chairman, President and CEO Gregg Steinhafel said Thursday in a statement.
Brianna Byrnes of Kansas City, Mo., a student at the University of Missouri-Kansas City and a call center worker, said she made a Target purchase during the affected period. The situation made her "a little bit" nervous, but she still plans to shop for toys at the store, she said.
"I've never had anyone steal my identity. I guess it's taking a risk."
The incident is particularly troublesome for Target because it has used its store-branded credit and debit cards as a marketing tool to attract shoppers with a 5 percent discount.
During an earnings call in November, the company said some 20 percent of store customers as of October have the Target-branded cards. In fact, households that activate a Target-branded card have increased their spending at the store by about 50 percent on average, the company said.
"This is how Target is getting more customers in the stores," said Brian Sozzi, CEO and Chief Equities Strategist. "It's telling people to use the card. It's been a big win. If they lose that trust, that person goes to Wal-Mart."
TJX Cos., which runs stores such as T.J. Maxx and Marshall's, had a breach that began in July 2005 and exposed at least 45.7 million credit and debit cards to possible fraud. The breach was not detected until December 2006.
Without anyone noticing, one or more intruders installed code on the discount retailer's systems to methodically collect and transmit account data from millions of cards.
In 2009, TJX agreed to pay $9.75 million in a settlement with multiple states.
Litan doubts the breach will have much effect on Target's sales, noting that TJX launched sales promotions immediately following the news of its breach. The effort increased sales.
"People care more about discounts than security," Litan said.
Associated Press writers Michelle Chapman in New York and Heather Hollingsworth in Kansas City, Mo., contributed to this report.
Follow Anne D'Innocenzio at __www.Twitter.com/adinnocenzio
- Weighing in: The top 20 metro areas with the...
- 50 things about 'The Sound of Music' to help...
- Villarica volcano erupts in Chile, thousands...
- Microsoft co-founder says he found sunken...
- NYC churches go on the market, leaving...
- Israel's Netanyahu warns US 'bad deal' would...
- Supreme Court justices sharply divided over...
- Body-camera maker has financial ties to...
- Israel's Netanyahu warns US 'bad deal'... 71
- Utah assails Obama's Clean Power Plan 28
- Clinton used personal email account as... 27
- AP EXPLAINS: Supreme Court case against... 26
- Supreme Court justices sharply divided... 18
- Kerry tries to dampen fuss over Israeli... 16
- Obama plans trip to South Carolina,... 15
- Personal email account revives old... 15