So I did the thing you're not supposed to do, which is swipe my debit card at a Target register twice during exactly the window everybody's now telling you to worry about. Once around Black Friday for stuff I don't even remember buying, and again on December 14th for stocking stuffers, because I am apparently incapable of finishing Christmas shopping before the last possible weekend. Target says the breach ran from November 27th through December 15th. So that's me, right in the middle of it, feeling very smart.
I'd mostly filed this under "not my problem" when it first broke on the 19th. Forty million cards is a big enough number that it stops feeling personal, like reading a headline about a hurricane somewhere else. Then yesterday the story updated: turns out the hackers didn't just get card numbers and expiration dates, they got the encrypted PIN data too. Target's line is that the encryption key wasn't compromised, so your actual PIN should still be safe even though the scrambled version of it got walked out the door. I want to believe that. I also want to believe a lot of things.
Here's the part that actually got me checking my banking app four times a day instead of the usual zero: a $4.17 charge at a gas station in Ohio showed up on my statement on the 23rd. I have never been to Ohio. I don't even know what's in Ohio, no offense to Ohio. It's a small enough amount that I almost scrolled past it, and I think that's the actual design of these things, small test charges that don't trip anybody's fraud alarm. My bank canceled the card within about four minutes of me calling, which was nice, except then I spent forty-five minutes on hold with hold music that I'm fairly certain was a single 90-second loop of smooth jazz, and I had already memorized the saxophone part by the time a human picked up.
New card takes 7 to 10 business days, they said, which is a very funny thing to tell someone during the exact week when 7 to 10 business days basically means "sometime next year." I've been using cash like it's 2004. Actually going to a physical ATM, watching the little roller counter, all of it. There's something almost pleasant about it once you get over the inconvenience, but I wouldn't recommend engineering the experience through a corporate data breach as your on-ramp back to analog money.
The thing that bugs me more than the breach itself, honestly, is how casual the messaging has been. Target's statement reads like a company that's been coached extremely well by lawyers, which I'm sure it has. "We regret any inconvenience this may cause." I got hacked over Christmas and the corporate response reads like they spilled coffee on my shoe. I don't need groveling, I just want somebody to sound like a human being said it out loud once before it went to the printer.
On a completely different note, and I promise this connects only loosely: my brother got an iPad mini for Christmas and immediately went and downloaded something like eleven apps before we'd even finished opening the rest of the presents, sitting on the couch with everybody else's wrapping paper still on the floor. Apple put out a note the day after Christmas saying it was their biggest App Store day ever, something like 15 million downloads on the 25th alone. I believe it. I watched it happen in real time from about four feet away, three of those downloads were flashlight apps for some reason, and one was immediately deleted.
Anyway. If you shopped at a physical Target register between late November and mid-December, go look at your statement right now, not tomorrow, now. Small charges first, the weird ones that look like they could be a fee. Cancel the card if anything looks off even slightly, eat the week of cash-only inconvenience, it beats explaining to your bank in February why there's a truck payment in Ohio on your account. And if anyone actually enjoys hold music, I'd genuinely like to meet you, because I do not understand what is happening in your brain.