Given that only 8.9 percent of shoppers had completely finished their holiday shopping by Dec. 13, according to the NRF, news of the breach could prompt procrastinators to head to competitors such as Amazon or Wal-Mart for items on their lists during the last critical week. "Forty-million is a large number, and it doesn't take a lot to make a difference," said David Strasser, a retail analyst for Janney Montgomery Scott.
A Target spokeswoman said the retailer is currently focused on handling the guests affected by the breach.
Helen Lane of Newport News, Va., is among those Target shoppers who are making alternate plans. "I'm usually in Target once a week, but around this time of year? I've been there three times this week," said Lane, a graphic designer. She hasn't heard yet from Target if her store REDcard, which links to her checking account, was among those affected. But she said she's unwilling to risk her balance until she gets the all-clear, or a new card.
"I probably won't go there for a few weeks until they figure this out," Lane said. Instead, she'll head to the nearby Trader Joe's and Wal-Mart.
Other Target customers concerned about their accounts were unable to get answers Thursday. Target's credit card web site has been down, and its toll-free hotline for questions about the breach was jammed. A Target spokesperson told CNBC that the security breach had resulted in higher than normal volume, which the retailer was working to resolve.
Target said Thursday the breach involved customer names and debit and credit card numbers, as well as card expiration dates and the cards' three-digit CVV security codes. The store said customers who shopped there between Nov. 27—two days before Black Friday—and this past Sunday should review their accounts for suspicious activity.
In a statement, Target said it has "identified and resolved the issue of unauthorized access to payment card data." The retailer said it alerted authorities and financial institutions of the breach, and will investigate with the aid of a third-party forensics firm.