NEW YORK — Target says anyone who made purchases by swiping cards at terminals in its U.S. stores between Nov. 27 and Dec. 15 may have had their accounts exposed to a real-life Grinch who stole the credit and debit card information of about 40 million shoppers.

The stolen data includes customer names, credit and debit card numbers, card expiration dates and the three-digit security codes located on the backs of cards. The stolen information included Target store brand cards and major card brands such as Visa and MasterCard.

The data breach did not affect online purchases, the company said.

QUESTION: I shopped at Target during that time. What should I do?

ANSWER: Check your credit card statements carefully. If you see suspicious charges, report the activity to your credit card companies and to Target at 866-852-8680. You can report cases of identity theft to law enforcement or the Federal Trade Commission. You can get more information about identity theft on the FTC's website at www.consumer.gov/idtheft, or by calling the FTC at 877-438-4338.

QUESTION: How did the breach occur?

ANSWER: Target isn't saying how it happened. Industry experts note that companies such as Target spend millions of dollars each year on credit card security, making a theft of this magnitude particularly alarming.

Experts disagree about how the breach might have happened. Avivah Litan, a security analyst with Gartner Research, says given all the security, she believes the breach may have been an inside job.

But thefts of this size are too big to be the work of company employees, says Ken Stasiak, founder and CEO of Secure State, a Cleveland-based information security firm that investigates data breaches like this one. Stasiak says that such breaches are generally perpetrated by organized crime or an overseas, state-sponsored hacker group.

Stasiak's theory is that the hackers were able to breach Target's main information hub and then wrote a code that gave them access to the company's point of sale system and all of its cash registers. That access allowed the hackers to capture the data from shoppers' cards as they were swiped.

QUESTION:Who pays if there are fraudulent charges on my account?

ANSWER: The good news is in most cases consumers aren't on the hook for fraudulent charges.

Credit card companies are often able to flag the charges before they go through and shutdown your card. If that doesn't happen, the card issuer will generally strip charges you claim are fraudulent off your card immediately. Since the fraud has been tied to Target, it'll be the retailer that ultimately compensates the banks and credit card companies.

QUESTION:How can I protect myself?

ANSWER: Like they say, cash is king. You can only lose what you're carrying, though admittedly many people may not feel safe walking around with a wad of bills in their pockets.

As stated before, credit card companies don't hold consumers liable for charges they don't make. Usually the worst thing consumers have to deal with is the hassle of getting a new credit card.

It's worth noting that while debit cards offer many of the same perks as credit cards, without the worry that you'll spend more than what's in your bank account, they often don't come with the same kind fraud protections. As a result, those card holders may have a tougher time getting their money back if their number is stolen.