EMVCo set the bar for card authentication in the 90's. This "bar" doesn't include encryption of the cardholder data, so doesn't neutralize a breach, and doesn't address the rapidly growing e-commerce card theft risk . Adopting EMV today follows an EMV mandate thats come very late relative to the rest of the world - deploy by Oct 2015 or face the cost of breach liability. Its not a choice. Target is following, not leading. If it was leading, as many retailers and payment processors are today and have done so for the last 4 years since the Heartland breach, it would have had End-to-end device to host encryption for card authorization processes, and tokenization for post authorization card processes and POS storage instead of live data, making the data useless to attackers. The breach would have been an inconvenience and not a career limiting and revenue impacting major event.