WASHINGTON–A Target executive told a full Senate JudiciaryCommittee Tuesday the retailer had no knowledge of the malware onits system until the Justice Department notified it of the securitybreach on the evening of Dec. 12.

John J. Mulligan, Target executive vice president and chieffinancial officer, also said a move to chip-and-PIN technologywould cost Target $100 million.

He added that Target explored chip-and-pin Target Visa REDcardsalmost 10 years ago, but the program was later cancelled.

Mulligan also confirmed what has been reported about the breach:the theft included personal data and included both point-of-salemalware and stolen vendor credentials.

As the forensic investigation continued, Mulligan said Targetlearned that the malware also captured some strongly encrypted PINdata.

Mulligan said social security numbers were not compromisedduring the breach that impacted 40 million debit and credit cardaccounts.

“We are working closely with the U.S. Secret Service and theU.S. Department of Justice on the investigation – to help bring tojustice the criminals who perpetrated this wide-scale attack onTarget,” Mulligan said.

Michael Kingston, senior vice president and chief informationofficer of The Neiman Marcus Group, told the committee that PINdata was not compromised in the data breach suffered by NeimanMarcus in December since the retailer does not use PIN pads.

Committee member Sen. Dianne Feinstein (D-Calif.) said in thepast, she found retailers did not want to notify individualcustomers of breaches. Any data security bill should require suchnotification, she declared.

Sen. Al Franken (D-Minn.) agreed federal law should set datasecurity standards for retailers and financial institutions, andrequire retailers to tell their customers when their data has beenstolen.