COMMUNICATION STRATEGIES
Banks and credit unions are taking differing approaches to dealing with the recent security breach involving credit cards and debit cards used at Target stores over the holidays. Some banks are identifying compromised debit or credit cards and issuing fresh cards immediately while other banks are taking a watch-and-wait stance, taking action on a case-by-case basis if fraud is detected.
Either way, many banks are using a proactive, multichannel approach for keeping customers informed which can build much sought after loyalty and trust.
In what may turn out to be the largest data breach of its kind, Target reported in December that hackers had stolen credit card and debit card information connected to as many as 40 million customers who shopped at Target stores between Nov. 27 and Dec. 15. Since then, Target has issued additional information that another 70 million customers may have had personal information compromised, including names, phone numbers and email addresses.
Subsequently, Neiman Marcus revealed it too had been the victim of a security breach, and there are some reporting that the POS system hacking could extend to additional retailers.
The full magnitude of the damage will not likely be known until later in January, when customers receive and examine their monthly statements and call their banks, security experts have said. In past cases, it has taken 30 to 45 days for the vast majority of bad charges to surface. Unfortunately, in a scenario with so much publicity, the impact of the breach may be felt for months . . . or longer.
So, the question is - What is the best way to communicate around a data breach of this nature? In working with a leading communications tracking firm, Competiscan, I was able to see a variety of communication strategies involving multiple channels and a variety of resolutions to the Target data breach.
"In today's environment, it's not a matter of if a data breach will occur, but when it will occur, and how well you respond. Do everything you can to prevent data breaches, but also fully plan out how you will respond if a breach occurs. Today's media and consumer demands that two-pronged approach." - Brian Lapidus, COO, Kroll Fraud Solutions
Target Communication
The one thing that should be part of any crisis plan is the reality that you might have to be in communication with hundreds of thousands of customers instantly. Unfortunately, while Target did 'go public' almost immediately after becoming aware of the situation, they were not prepared to handle the volume of calls or visits to their website/Facebook page that occurred. For instance, Target's initial notification post garnered over 3,500 comments and 1,600 shares in the first few days from customers concerned about their card security.
The same is true for the financial institutions that have been tracked. While some communicated with customer as early as December 20th (the day after the initial discovery), some organizations have not yet reached out to all customers to explain what has occurred, what precautions can be taken and how the bank is working on their behalf.
According to a Reuters/Ipsos poll conducted from January 2 to January 10, 40 per cent of people who shopped at Target during the period of the data breach had not been notified about the incident. Thirty-one per cent said they had been notified by Target and 28 per cent said they had been notified by their bank or credit card company.
This is an opportunity lost at a time when trust between customers and their financial institution is still fragile from the past financial crisis.
"More than 55 percent of respondents said the notification about a data breach occurred more than one month after the incident, and more than 50 percent of respondents rated the timeliness, clarity and quality of the notification as either fair or poor." - The Consumer's Report on Data Breach Notification
The day after the initial reports surfaced, Target emailed millions of customers it thought were affected, and for whom it had email addresses. It has done the same for the additional customers it's now found to be involved.
The company also created a dedicated page on its website for the data breach, including resources about identity theft and credit reports. Target has said that it plans to offer a year of free credit monitoring and identity theft protection to anyone who shopped in Target stores in the United States.
Finally, Target also sent postal letters and posted a series of short YouTube videos to explain details around the security breach, what the company was doing about the situation, and a discount offer to customers. It also provided the first set of steps a customer could take to protect themselves and where they could go for additional information.
![]() |
| Target Letter to Customers |
One of a series of YouTube videos from Target CEO to customers

















