Which statement about the Target breach is true?

• A. It affected online purchases only.
• B. It involved only payment data.
• C. It affected no customer data.
• D. It affected in-store customers, with names, mailing addresses, phone numbers, and email addresses stolen.

Answer: (D)

Data breaches often expose more than just payment data; they can leak personal information tied to customers. In Target’s case, attackers gained access to the retailer’s systems and, in addition to stealing payment card data from in-store point-of-sale terminals, also exposed personal details such as names, mailing addresses, phone numbers, and email addresses of a large number of customers (up to about 70 million).

That means the statement about in-store customers having their personal information stolen is true. The other options misstate the scope: the breach was not limited to online purchases only, it did not involve only payment data, and it did affect customer data.