Blog

Consumer frustration and outrage over the Target credit card breach is moving from Facebook and Twitter to the courts and state governments even as the stolen accounts are flooding the black market.

Three class-action lawsuits have been filed in the wake of the theft of data on about 40 million credit and debit card accounts of shoppers at Target from Nov. 27 to Dec. 15. More than $5 million in damages is being sought in the cases, two of which were filed in California and one in Oregon.

The Attorney General in at least four states -- Connecticut, Massachusetts, New York and South Dakota - have asked Target for information about the breach. That's the first step to a possible multi-state investigation into the breach.

Meanwhile, millions of the card accounts stolen have begun showing up for sale on the black market, says the security reporter who initially broke the news about the breach. "Credit and debit card accounts stolen in (the Target breach) ... have been flooding underground black markets in recent weeks, selling in batches of one million cards and going for anywhere from $20 to more than $100 per card," writes Brian Krebs on his KrebsOnSecurity.com site.

Over the weekend, Target offered customers a 10% discount in its U.S. stores, after CEO Gregg Steinhafel said on Friday that the company would provide free credit monitoring to at-risk customers.

The company may need to do a lot more in coming days. "With these data security breaches, there's usually the question of consumer confidence and trust," says Daren M. Orzechowski, a New York-based intellectual property attorney with White & Case LLP. "They have to balance if they feel they need to do more to try to preserve consumer confidence."