Target's Biggest PR Mistake With Credit Card Security Breach

http://www.forbes.com

The Target TGT +0.32% Holiday Credit Card Breach of 2013 is destined to become a fixture in the curriculum of crisis management. And not in a good way.

There is a very simple reason why, as the AP reports this morning, Target customers have reacted with “Fury and Frustration.” The retailer has played down the fact that its customers most needed to hear. In the notice on Target’s website about the “Unauthorized access to payment card data in U.S. stores,” the question of whether it is now safe to use your credit card at the company’s stores is relegated to the fourth question of a FAQ at the end of a 1,500 word statement.

So after eight minutes of reading time, Target finally answers the question on everyone’s mind directly:

Has the issue been resolved?
Yes, Target moved swiftly to address this issue so guests can shop with confidence. We have identified and resolved the issue of unauthorized access to payment card data. The issue occurred between Nov. 27 and Dec. 15 and guests should continue to monitor their accounts.

Talk about burying the lead! Credit card breaches happen all the time. As Forbes.com contributorLaura Heller points out, most shoppers don’t much care. But would you continue to use your credit card at a store that has told you that their very POS terminals have been compromised? Only if they also told you that the means of the point of sale data theft has been identified and closed down.

This is the last week of the Christmas shopping season and for many consumers getting that shopping done is top of mind. It is surprising that Target did not prioritize this message higher in their communication with its customers—the viability of their own Christmas season is at stake.

Understanding the needs and desires of your audience is key in any type of communication. Yes it is important to not come across as crass for reminding customers that you are still in business despite a regrettable incident, but relying solely on implication is a bad rhetorical practice. The first sentence of Target’s statement is, “We wanted to make you aware of unauthorized access to Target payment card data.” It could have easily continued, “We have identified and resolved this issue and guests can continue to shop with confidence.” That’s it. Then it could have moved on to the details of the incident and all of the things that customers can do to protect themselves retroactively.

And since most people only read the first few sentences of something before skimming anyway, this would have assured that the press picked this important fact up in its reporting of Target’s reaction to the crisis. As it was, it was left to customers to infer that because the issue occurred between November 27 and December 15 that therefore the source of the problem had been identified and resolved. Target had initially announced that the incidents had only occurred up until December 6, so at least to me, I needed to hear that the December 15 date was a definitive cutoff.

This raises the alarming possibility that Target did not play this fact  up with more certainty because they can’t. Security is often like a game of Whack-a-Mole and it is hard to be certain you have whacked them all. Target has a very solid reputation for security and has generally been very saavy about its communication of its brand to its customers, but the present incident reveals a tin ear for what consumers need to hear to feel safe. People like Target and just need permission to continue shopping there. As Avivah Litan, a security analyst with Gartner Research told the AP, “People care more about discounts than security.”  Next time, just tell us it’s safe to go back in the water, OK?