A source told Reuters that investigators believed overseas hackers orchestrated the cyber attack on Target Corp which led 40 million payment cards to be compromised on the first three weeks of the holiday shopping season, Reuters reported. The person who had knowledge about the matter but was not authorized to talk about it publicly did not say how the hackers were able to gain access or where the investigating authorities believe they were operating from since the investigators did not want to show their hands to the perpetrators.

The report also said that Brian Krebs, the blogger who first revealed the news, said the stolen data had started to make the rounds in underground markets selling stolen credit cards. The blog KrebsOnSecurity.com said on Friday, December 20 that these cards were already on offer for $20 to over $100 at "card shops."

According to Target, the hackers were able to obtain data on as many as 40 million payment cards in the 19 days until December 15, the report said. Considered as the second biggest retail breach in the history, the retailer only reported the attack one day after Krebs had already written about it. The retailer did not also specify how their systems were breached and did not give a lot of details about the case, the report said.

Target assured customers that it was still safe to shop at its stores, offering 10% discount on majority of its merchandise on the last weekend before Christmas, to encourage them to do so. Target spokeswoman Molly Snyder said only the data stored on the magnetic strip was stolen by the hackers. They were not able to get PIN numbers that were used to get access to the ATMs nor were they able to get the three or four-digit security codes printed on the cards to be able to validate the online purchases made by the customers.