You swiped your card -- and they swiped your data.

The credit and debit card numbers of around 40 million people were stolen in a massive data breach at the Target chain of stores, just as the holiday shopping season shifted into high gear. Customers who made purchases by swiping at terminals in its U.S. stores between Nov. 27 and Dec. 15 may have had their names, credit and debit card numbers, card expiration dates and the three-digit security codes stolen, the company said.

The data breach did not affect online purchases, however, which may have shoppers turning in even greater numbers to the web. But online shopping has its own hazards. Here’s how to shop safely this year.