text: During an interview with CNBC, retailer's CEO defends four-day delay in notifying customers of security breach as necessary for the investigation and preparation for consumer reaction. 
   
   Hackers infected Target's point-of-sale terminals with malware to steal the payment card information from millions of customers, the retailer's chief executive has confirmed. 
   
   The security breach, which yielded the personal information of as many as 110 million customers, was first identified on December 15, four days before the breach was publicly revealed, CEO Gregg Steinhafel told CNBC during an interview. Target revealed Friday that the security breach it suffered between November 27 and December 15 was larger than originally believed, yielding the names, mailing addresses, phone numbers, and e-mail addresses for near three times its original estimate of 40 million customers. 
   
   "Sunday [December 15] was really Day 1. That was the day we confirmed we had an issue and so our number one priority was ... making our environment safe and secure," Steinhafel said in the interview. "By six o'clock at night, our environment was safe and secure. We eliminated the malware in the access point, we were very confident that coming into Monday guests could come to Target and shop with confidence and no risk." 
   
   Steinhafel defended the four-day delay in its notification process as necessary for investigators and consumer preparation. 
   
   "Day 2 was really about initiating the investigation work and the forensic work ... that has been ongoing. Day 3 was about preparation. We wanted to make sure our stores and our call centers could be as prepared as possible, and Day 4 was about notification," he told CNBC in an interview scheduled to air Monday. 
   
   Target was not the only US retailer to suffer a security breach during the holiday shopping season. Upscale department store Neiman Marcus confirmed on Friday that its database of customer information was hacked last month around the same time as the attack on Target. Additionally, Reuters reports that at least three other well-known but unidentified retailers experienced smaller breaches that have yet to be publicly revealed. 
   
   The practice of payment card skimming at point-of-sale terminals has become more frequent in recent years, often victimizing customers of well-known retailers. Bookseller Barnes & Noble discovered in fall 2012 that hackers had broken into keypads at more than 60 locations around the United States and made off with customers' credit card information. That same month, two Romanian men pled guilty to hacking point-of-sale terminals at hundreds of Subway sandwich stores in the US to steal credit card data from more than 146,000 accounts. ||||| Since Target's original announcement that up to 40 million customer credit and debit card accounts had been hacked, critics have questioned why it took the retailer four days to come clean on the data breach. 
   
   
   
   Now, for the first time since the security breach was announced on Dec. 19, Target Chairman and CEO Gregg Steinhafel is speaking out. While four days may seem like a long time for consumers to learn their sensitive account information was at risk, Steinhafel argued that it was lightning speed from Target's perspective. 
   
   
   
   He laid out what happened from the moment he knew there was a problem. 
   
   (Read more: 'I'm still shaken' by Target data breach, says CEO) 
   
   "Sunday (Dec. 15) was really day one. That was the day we confirmed we had an issue and so our number one priority was ... making our environment safe and secure. By six o'clock at night, our environment was safe and secure. We eliminated the malware in the access point, we were very confident that coming into Monday guests could come to Target and shop with confidence and no risk," Steinhafel said. 
   
   
   
   "Day two was really about initiating the investigation work and the forensic work ... that has been ongoing. Day three was about preparation. We wanted to make sure our stores and our call centers could be as prepared as possible, and day four was about notification," he added. (The full interview will air on CNBC's Squawk Box Monday.) ||||| BOSTON/NEW YORK (Reuters) - Target Corp began a major public relations effort on Monday to apologize to customers for an unprecedented cyber attack on its network, but the No. 3 U.S. retailer was vague in providing details about what it knew and when. 
   
   The company has so far disclosed that the breach started in late November and lasted 19 days over the peak holiday shopping season, resulting in the theft of about 40 million credit card records and 70 million other records containing customer data. 
   
   Target is trying to woo back customers after sales dropped off at the end of the holiday season. Its campaign included full-page newspaper advertisements on Monday apologizing for the attack and the first interview since the breach by chief executive Gregg Steinhafel. 
   
   He told CNBC TV business network that Target wanted to lead the retail industry’s move to adopt payment card technology that stores customer information on computer chips and requires users to type in personal identification numbers. 
   
   On Sunday, a top executive with the National Retail Federation called for tougher security standards that could mean more spending for the industry, its banks and business partners following the breaches at Target and other retailers in the United States. 
   
   Steinhafel said he was proud of the way Target employees had responded once the breach was confirmed, yet he provided few details about what had happened. 
   
   Target disclosed on December 19 that it was victim to one of the biggest credit card breaches on record. It said it ran for 19 days in the busy holiday shopping season through December 15. 
   
   “We’re going to get to the bottom of this,” Steinhafel told CNBC. “We’re not going to rest until we understand what happened and how that happened.” 
   
   The company declined to say precisely when it first came to suspect its systems might have been compromised. 
   
   Related Coverage Changing card PIN only first step after Target breach: experts 
   
   In the CNBC interview, Steinhafel said the company “confirmed” that it had been victim of a breach on December 15, but he provided no account of what happened in preceding weeks. 
   
   “December 15. That was the day we confirmed that we had an issue,” he said. 
   
   Sources familiar with the investigation have previously told Reuters that Target learned about the attack only after receiving warnings from financial industry sources who reported seeing a surge in fraudulent credit card activity from accounts of customers who had shopped at the retailer. 
   
   Another retailer, Neiman Marcus, disclosed on Friday that it was warned about a possible breach in mid-December and that an outside forensics firm confirmed a breach on January 1, saying it found evidence that some payment card data may have been compromised. 
   
   Target and Neiman Marcus are not the only U.S. retailers whose networks were breached over the holidays, according to sources familiar with attacks on other merchants that have yet to be publicly disclosed. 
   
   Smaller breaches at least three other well-known U.S. retailers took place over the holiday season and were conducted using similar techniques as the one on Target, according to the people familiar with the attacks. Similar breaches may have occurred earlier last year. 
   
   Stores and card processing companies have reported a steady stream of security breaches for years without a major backlash from consumers, such as those disclosed by TJX Cos in 2007 and by Heartland Payment Systems Inc in 2009. 
   
   But the latest thefts could mark a watershed moment for security standards as calls grow for changes in the protection of consumer information. 
   
   ‘CHIP-AND-PIN’ CARDS 
   
   People shop at a Target store during Black Friday sales in the Brooklyn borough of New York, in this November 29, 2013, file photo. REUTERS/Eric Thayer/Files 
   
   One sign of the change is the new enthusiasm for “Chip-and-PIN” payment cards, which have computer chips built into them and require users to type in PINs. 
   
   Mallory Duncan, general counsel of the National Retail Federation that represents Target, Wal-Mart and other stores, said on Sunday that the trade group encouraged its members to upgrade to the higher-security cards even though they cost more than old systems that store data on magnetic stripes. 
   
   The breaches are “unfortunate but we’re not entirely surprised,” Duncan said at his organization’s annual convention in New York. 
   
   “The technology that exists in cards out there is 20th-century technology and we’ve got 21st-century hackers,” he said. 
   
   Duncan said the trade group had only made its backing for the higher-security cards public since the Target breach. Banks have quietly begun to offer the cards but mainly for customers to use while traveling. Big U.S. card networks led by Visa Inc will not require the higher security until next year at the earliest. 
   
   It is not clear that “Chip-and-PIN” technology would have prevented the breaches at Target and elsewhere. At the very least they make stolen data harder to re-use, a reason the technology has caught on widely in Europe and Asia. 
   
   They have met with much less enthusiasm in the United States, in part because losses to fraud - just 5 cents for every $100 spent via plastic - have been manageable for merchants and their banks. But rising fraud rates, and the risk of identity theft, could change the calculation. 
   
   The new scrutiny began after Target disclosed its breach. Investigators believe hackers used malware that captured data on customers from the magnetic stripes on their payment cards. 
   
   Duncan said no other members had told the NRF they had been breached. 
   
   Executives of several other companies said over the weekend that they were not aware of breaches at their companies. The executives included representatives of Sears Holdings Corp, JCPenney Co, Macy’s Inc and Gap Inc. 
   
   A shopper enters a Neiman Marcus store in Oak Brook, Illinois, a suburb of Chicago, in this May 2, 2005 file photo. REUTERS/John Gress/Files 
   
   Still, the breach was the talk of the retail conference with 29,000 attendees. Several speakers cited it in remarks and some tried to distance their companies from vulnerabilities. 
   
   Stan Lippelman, vice president of marketing at Bass Pro Shops, a privately-held outdoor goods seller, said: “We feel very comfortable with where we are at. But...the fact that it happens to Target means it can happen to anybody, right?”
target: – Victims of the Target hack were hit as they slid their payment cards through point-of-sale terminals, says the company's CEO: That's where hackers placed their malware, Gregg Steinhafel tells CNBC. On Sunday, Dec. 15, the company recognized "we had an issue," and "by six o'clock at night, our environment was safe and secure. We eliminated the malware in the access point." Steinhafel explained why it still took a few days to alert customers, CNET reports: "Day two was really about initiating the investigation work and the forensic work," while "day three was about preparation" of stores and call centers. After Neiman Marcus revealed that it, too, was hit with a data breach, Reuters reports that three other top US retailers were also victimized, though on a smaller scale. Insiders say the people behind the scam may have been the same ones who hit Target. Details remain hazy, but Reuters' sources say the other retailers had mall outlets. Earlier attacks may have worked as trials ahead of the Target hack, notes a security expert. One technique hackers may have used is called RAM scraping, during which hackers collect encrypted data when it's in plain-text form in a computer's memory.