Target, which has almost 1,800 stores in the U.S. and 124 in Canada, said it immediately told authorities and financial institutions once it became aware of the breach on Dec. 15. The company is teaming with a third-party forensics firm to investigate and prevent future problems.
The credit card breach poses a serious problem and threatens to scare away shoppers who worry about the safety of their personal data.
Target's stock dropped more than 2 percent, or $1.40, to $62.15 on Thursday.
"This is close to the worst time to have it happen," said Jeremy Robinson-Leon, a principal at Group Gordon, a corporate and crisis public relations firm. "If I am a Target customer, I think I would be much more likely to go to a competitor over the next few days, rather than risk the potential to have my information be compromised."
Target advised customers Thursday to check their statements carefully. Those who see suspicious charges should report them to their credit card companies and call Target at 866-852-8680. Cases of identity theft can also be reported to law enforcement or the Federal Trade Commission.
"Target's first priority is preserving the trust of our guests, and we have moved swiftly to address this issue, so guests can shop with confidence," Chairman, President and CEO Gregg Steinhafel said Thursday in a statement.
Brianna Byrnes of Kansas City, Mo., a student at the University of Missouri-Kansas City and a call center worker, said she made a Target purchase during the affected period. The situation made her "a little bit" nervous, but she still plans to shop for toys at the store, she said.
"I've never had anyone steal my identity. I guess it's taking a risk."
The incident is particularly troublesome for Target because it has used its store-branded credit and debit cards as a marketing tool to attract shoppers with a 5 percent discount.
During an earnings call in November, the company said some 20 percent of store customers as of October have the Target-branded cards. In fact, households that activate a Target-branded card have increased their spending at the store by about 50 percent on average, the company said.
"This is how Target is getting more customers in the stores," said Brian Sozzi, CEO and Chief Equities Strategist. "It's telling people to use the card. It's been a big win. If they lose that trust, that person goes to Wal-Mart."
TJX Cos., which runs stores such as T.J. Maxx and Marshall's, had a breach that began in July 2005 and exposed at least 45.7 million credit and debit cards to possible fraud. The breach was not detected until December 2006.
Without anyone noticing, one or more intruders installed code on the discount retailer's systems to methodically collect and transmit account data from millions of cards.
In 2009, TJX agreed to pay $9.75 million in a settlement with multiple states.
Litan doubts the breach will have much effect on Target's sales, noting that TJX launched sales promotions immediately following the news of its breach. The effort increased sales.
"People care more about discounts than security," Litan said.
Associated Press writers Michelle Chapman in New York and Heather Hollingsworth in Kansas City, Mo., contributed to this report.
Follow Anne D'Innocenzio at __www.Twitter.com/adinnocenzio
- Live at the GOP convention: Donald Trump...
- Trump speechwriter apologizes for Melania...
- Thunderous boos for Cruz for refusing to...
- 17 arrested in flag-burning melee outside GOP...
- Trump's moment: Speech to close GOP...
- Cruz: Not supporting candidate who wages...
- Rupert Murdoch vows Fox News without Ailes is...
- NBA moving All-Star Game out of Charlotte,...
- Utah delegates finally stand and cheer... 93
- Utah GOP delegates finally fired up... 75
- Obama rejects Trump depiction of US in... 40
- The day after: Lee defends Cruz at GOP... 32
- Trump speechwriter apologizes for... 27
- Police give all-clear in Munich... 27
- Thunderous boos for Cruz for refusing... 22
- Ohio Mormon offered invocation at... 22