2013Data breachSupply chain
Target payment card breach
November to December 2013
Attackers stole payment card data from Target's US stores during the 2013 holiday season by installing malware on point-of-sale systems. Public reporting and a US Senate committee staff report described the attackers first entering Target's network with credentials stolen from a third-party vendor, a heating and ventilation contractor.
- Victim
- Target Corporation and its customers
- Sector
- Retail
- Public attribution
- Not attributed to a named group in the cited sources.
Impact
The Senate Commerce Committee staff report described the breach as affecting as many as 110 million consumers.
Root cause
Vendor credentials gave access to a network that was not segmented well enough to keep attackers away from payment systems, and the staff report found automated security alerts were not acted on.
Lessons learned: the controls it teaches
- Segment networks so third-party access cannot reach cardholder data environments (PCI DSS).
- Give vendors least-privilege, monitored access with MFA.
- Tools only help if alerts are triaged and acted on.