AUSTIN -- It's supposed to be the most wonderful time of the year, but a shopping Grinch is tainting the holiday spirit.
From Nov. 27 until Dec. 15, millions of people swiped their debit, credit and REDcards at Target stores. Now, some 40 million of them are at risk of identity theft.
"I think of all the times I've come to Target, and I'm kind of flabbergasted. I just used my credit card again," said Target customer Kathy Estrada.
"This seems like a pretty planned, strategic attack. Very high volume, and we don't see a lot of that sort of point of sale hacking. This is perhaps a new vector of attack," said Bryan Hjelm, Vice President of Product and Marketing for CSID.
CSID is a technology provider for identity protection and monitoring that also mitigates security breaches for corporations. It is also the company that provides security for LifeLock.
While Target officials have not said exactly how hackers stole the information, Hjelm and other tech experts said they likely installed a virus in Target's system to steal the information embedded in the magnetic strip on the back of a card.
"There was probably some malware or some hacking activity between that point of sale system and the software that is on the computers that you see when your card is registering," said Hjelm.
"The name, the card number, the expiration date," said Brian Krebs, editor of KrebsonSecurity.com. "If the bad guys can steal that information off the back of the card, they can actually create a second copy."
Hackers can also sell that information, or just use it online to make a purchase.
So what can you do if you worry your card information was compromised? Experts say to keep a close eye on your credit and debit card statements, and report any transactions you didn't make. Target is also asking customers to tell them if they notice suspicious activity. Customers should also monitor their credit reports, checking for new cards opened in their names.
Target officials informed financial institutions of the breach, but if people want to be extra diligent, Hjelm said there's no harm in canceling a card and ordering a new one.
As for what Target will do next, experts said the company can do nothing and risk civil lawsuits, or they can offer the affected customers some sort of identity protection.