The cybercrooks behind Target’s data breach made off with the personal identification numbers of millions of customer debit cards, contrary to the company’s initial report. 
 
 The Minneapolis retail giant on Friday confirmed that PINs were stolen but added in an e-mailed statement that the numbers were “strongly encrypted” and the debit card accounts have not been compromised. Despite their theft, the PINs are still “safe and secure,’’ Target said. 
 
 Target acknowledged the breach Dec. 19 after an IT security blogger reported that customer names, credit and debit card numbers, expiration dates and CVV codes were stolen from the company. In the days that followed, Target repeatedly said PINs weren’t compromised or affected. 
 
 PINs hold special value for card thieves as they make it easy to quickly cash out a card and drain an unsuspecting victim’s checking account. 
 
 Company spokeswoman Molly Snyder said in a statement that “the ‘key’ necessary to decrypt that data has never existed within Target’s system and could not have been taken during this incident.” 
 
 The company declined to elaborate. 
 
 Target’s confidence in the PIN encryption is likely justified, said several data security experts interviewed by the Star Tribune. PIN encryption technology is “pretty rock solid,” said Jacob Ansari, a forensics investigator at 403 Labs LLC in Brookfield, Wis. 
 
 Data specialists cautioned, however, that no security is perfect. It’s possible to crack encryption using so-called brute force methods, said Kevin Mandia, CEO of cybersecurity firm Mandiant Corp. in Alexandria, Va. 
 
 Tough PIN encryption might stop a thief from running to the ATM, but it doesn’t offer protection against stolen debit cards being used for fraud online, and it doesn’t prevent debit cards from being run as credit cards without the PIN. 
 
 PIN encryption also doesn’t address the credit card information pilfered during the cyberattack. 
 
 The 19-day breach, which was caught relatively quickly, is among the country’s largest recorded data security breaches. It exposed the credit and debit card information of 40 million people who paid with plastic at U.S. Target stores between Nov. 27 and Dec. 15. 
 
 The stolen information included all types of credit and debit cards, including Target’s own Redcard. 
 
 Target is still trying to determine how the attack happened. What is known is that malicious software infected the point-of-sale terminals in the company’s U.S. stores, where shoppers swipe their cards. The intrusion remains under investigation by the Secret Service, the Justice Department, Target and a third-party forensics team. 
 
 The company said it’s still in the early stages of a “criminal and forensic investigation,” and is not under investigation itself. 
 
 Target has been hit with more than a dozen lawsuits across the country from angry shoppers who have accused the company of lax security that failed to protect their sensitive financial information. 
 
 While the origin of the attack remains a matter of speculation, Mandia, the cybersecurity expert, suspects the Target attack originated outside the country. 
 
 “Almost every attack of consequence, like the one at Target, came out of Russia,” said Mandia, who has been responding to such attacks for two decades. “I know of very few exceptions.” 
 
 An attack from outside the U.S. makes the most sense, Mandia said, because there’s less risk of being prosecuted. “We just don’t have the jurisdictional reach back.” 

 Target confirmed Friday that debit card PIN data was stolen in its recent massive breach, reversing its earlier stance that the codes were not part of the hack. 
 
 However, the retailer believes the PINs remain "safe and secure." In a statement, Target (TGT) spokeswoman Molly Snyder said the PINs are "strongly encrypted" and were never stored on Target's systems in plain text. 
 
 In other words, from the moment a customer entered a PIN after swiping a debit card, Target's payment system translated that number into an indecipherable string of code. Target claims that the PINs remained encrypted after they were stolen. 
 
 Not only are the PINs encrypted, Target says the numbers can only be decrypted by the independent payment processor, which holds the decryption key. That key is necessary to translate the unintelligible code back into the PIN. Target said the key was not stolen as part of the breach, because it never existed within the company's systems. 
 
 Target hack: The latest 
 
 Target says it uses the Triple Data Encryption Standard to encrypt its PIN codes. Per Thorsheim, an Independent password security consultant, said the PINs encrypted with the Triple DES algorithm would be "difficult or impossible to decrypt," if the payment processor's decryption key was robust enough. Target declined to comment on the identity of its payments processor. 
 
 That means it is very unlikely that thieves would be able to withdraw money from ATMs using stolen debit card information. Consumers are protected from certain instances of debit card fraud, but cash withdrawals and purchases made with a PIN can be tricky to reverse. 
 
 As a precaution, Target customers who shopped at Target when the breach occurred should contact their banks to request a replacement card and change their PIN. 
 
 The PIN theft revelation means that Target's payment systems breach was larger than initially thought. That is common in credit card breaches. When Marshalls' and TJ Maxx's parent company TJX (TJX) was hit with a massive breach in 2007, the company initially said 45 million accounts were hacked but upped that number to 94 million months later. 
 
 Target says that its breach, which took place between Black Friday and Dec. 15, compromised 40 million customers' payment information. 

 U.S. Senator Charles Schumer, is pictured through a Target shopping cart, as he holds a news conference about the massive credit card hack that has affected 40 million Target customers, in the Harlem area of New York December 22, 2013. 
 
 BOSTON/NEW YORK The hackers who attacked Target Corp and compromised up to 40 million credit cards and debit cards also managed to steal encrypted personal identification numbers (PINs), according to a senior payments executive familiar with the situation. 
 
 One major U.S. bank fears that the thieves would be able to crack the encryption code and make fraudulent withdrawals from consumer bank accounts, said the executive, who spoke on the condition of anonymity because the data breach is still under investigation. 
 
 Target spokeswoman Molly Snyder said "no unencrypted PIN data was accessed" and there was no evidence that PIN data has been "compromised." She confirmed that some "encrypted data" was stolen, but declined to say if that included encrypted PINs. 
 
 "We continue to have no reason to believe that PIN data, whether encrypted or unencrypted, was compromised. And we have not been made aware of any such issue in communications with financial institutions to date," Snyder said by email. "We are very early in an ongoing forensic and criminal investigation." 
 
 The No. 3 U.S. retailer said last week that hackers stole data from as many as 40 million cards used at Target stores during the first three weeks of the holiday shopping season, making it the second-largest data breach in U.S. retail history. 
 
 Target has not said how its systems were compromised, though it described the operation as "sophisticated." The U.S. Secret Service and the Justice Department are investigating. Officials with both agencies have declined comment on the investigations. 
 
 The attack could end up costing hundreds of millions of dollars, but it is unclear so far who will bear the expense. 
 
 While bank customers are typically not liable for losses because of fraudulent activity on their credit and debit cards, JPMorgan Chase & Co and Santander Bank said they have lowered limits on how much cash customers can take out of teller machines and spend at stores. 
 
 The unprecedented move has led to complaints from consumer advocates about the inconvenience it caused from the late November Thanksgiving holiday into the run-up to Christmas. But sorting out account activity after a fraudulent withdrawal could take a lot more time and be worse for customers. 
 
 JPMorgan has said it was able to reduce inconvenience by giving customers new debit cards printed quickly at many of its branches, and by keeping branches open for extended hours. A Santander spokeswoman was not available for comment on Tuesday. 
 
 Security experts said it is highly unusual for banks to reduce caps on withdrawals, and the move likely reflects worries that PINs have fallen into criminal hands, even if they are encrypted. 
 
 "That's a really extreme measure to take," said Avivah Litan, a Gartner analyst who specializes in cyber security and fraud detection. "They definitely found something in the data that showed there was something happening with cash withdrawals." 
 
 BREAKING THE CODE 
 
 While the use of encryption codes may prevent amateur hackers from obtaining the digital keys to customer bank deposits, the concern is the coding cannot stop the kind of sophisticated cyber criminal who was able to infiltrate Target for three weeks. 
 
 Daniel Clemens, CEO of Packet Ninjas, a cyber security consulting firm, said banks were prudent to lower debit card limits because they will not know for sure if Target's PIN encryption was infallible until the investigation is completed. 
 
 As an example of potential vulnerabilities in PIN encryption, Clemens said he once worked for a retailer who hired his firm to hack into its network to find security vulnerabilities. He was able to access the closely guarded digital "key" used to unscramble encrypted PINs, which he said surprised his client, who thought the data was secure. 
 
 In other cases, hackers can get PINs by using a tool known as a "RAM scraper," which captures the PINs while they are temporarily stored in memory, Clemens said. 
 
 The attack on Target began on November 27, the day before the Thanksgiving holiday and continued until December 15. Banks that issue debit and credit cards learned about the breach on December 18, and Target publicly disclosed the loss of personal account data on December 19. 
 
 On December 21, JPMorgan, the largest U.S. bank, alerted 2 million of its debit cardholders that it was lowering the daily limits on ATM withdrawals to $100 and capping store purchases with their cards at $500. 
 
 On Monday, the bank partly eased the limits it had imposed on Saturday, setting them at $250 a day for ATM withdrawals and $1,000 a day for purchases. (The usual debit card daily limits are $200 to $500 for cash withdrawals and $500 for purchases, a bank spokeswoman said last week.) 
 
 On Monday, Santander - a unit of Spain's Banco Santander - followed suit, lowering the daily limits on cash withdrawals and purchases on Santander and Sovereign branded debit and credit cards of customers who used them at Target when the breach occurred. Santander did not disclose the new limits, but said it was monitoring the accounts and issuing new cards to customers who were affected. 
 
 The largest breach against a U.S. retailer, uncovered in 2007 at TJX Cos Inc, led to the theft of data from more than 90 million credit cards over about 18 months. 
 
 (Reporting by Jim Finkle in Boston and David Henry in New York, Additional reporting by Dhanya Skariachan in New York; Writing by Paritosh Bansal, Editing by Tiffany Wu and Grant McCool)
– Ever since news broke of Target's massive security breach, the retailer has said that customers' PIN and debit card data hadn't been stolen. Today, it admitted that actually, it had been—which, according to the Minneapolis Star Tribune, makes the stolen cards significantly more likely to be fraudulently cloned. But Target says it's "confident that PIN numbers are safe and secure" because they were tightly encrypted. That means to read them, thieves would need a key that Target says never even existed in its system—the second customers put in their number, it was encrypted and sent to a third-party payment processor. An independent security expert tells CNNMoney that it would be "difficult or impossible to decrypt" Target's algorithm without that key. But an anonymous executive for a major US bank tells Reuters that they're worried nonetheless, and JPMorgan and Santander have both lowered their limits on ATM withdrawals as a precaution.