Target Data Breach (Nov 27 - Dec 18 2013)
Introduction
The Target data breach of 2013 is a landmark case in corporate cybersecurity history — not because it involved novel attack techniques, but because it demonstrated how a large, security-conscious organisation could be compromised through a third-party vendor with minimal network privileges. Over 21 days during the peak of the US holiday shopping season, attackers stole 40 million payment-card numbers and the personal information of 70 million customers.
The breach was first disclosed publicly not by Target but by cybersecurity journalist Brian Krebs, who reported it on 18 December 2013 based on information from banking industry sources. Target confirmed the breach the same day.
The Attack Vector: Third-Party Vendor Credentials
Entry to Target's network was not achieved by breaching Target's perimeter directly. Attackers obtained network credentials belonging to Fazio Mechanical Services, a Pennsylvania-based refrigeration, heating, and air-conditioning contractor that maintained systems in Target stores. Fazio had been granted remote access to Target's network for billing, contract submission, and project management purposes.
The credentials were obtained via a phishing email targeting Fazio employees, which installed the Citadel malware — a banking trojan variant. Fazio reportedly used a free version of Malwarebytes as its primary endpoint security software, which did not provide real-time protection against the Citadel infection.
Using the stolen Fazio credentials, attackers accessed Target's network and moved laterally to find the point-of-sale infrastructure. Security researchers and subsequent investigations noted that Target's network segmentation between vendor systems and payment systems was inadequate — the vendor portal should not have had a pathway to POS systems.
The BlackPOS Malware
Once inside Target's payment network, attackers deployed BlackPOS (also known as Kaptoxa), a RAM-scraping malware designed specifically to harvest payment card data from POS terminal memory. At the point of sale, card data is briefly unencrypted in system memory between swipe and encryption for transmission. BlackPOS captured this data in transit. The malware was installed on a significant fraction of Target's approximately 1,800 US store POS systems.
The stolen card data was staged on a server within Target's network before being exfiltrated to external servers. Security researchers later noted that Target's FireEye intrusion detection system had triggered alerts during the malware installation phase — alerts that were not acted upon.
Detection and Disclosure
The US Department of Justice notified Target of the breach on 12 December 2013. Target confirmed and publicly disclosed the breach on 18 December 2013, the same day Brian Krebs published his report. The initial disclosure covered 40 million payment cards; Target disclosed in January 2014 that an additional 70 million records of personal information — names, addresses, phone numbers, email addresses — had also been stolen.
Executive Accountability
CEO Gregg Steinhafel, who had been with Target for 35 years and served as CEO since 2008, resigned on 5 May 2014. The board stated that the resignation was "a mutual decision." CIO Beth Jacob resigned in March 2014. Both departures were widely attributed to the breach and the company's handling of it.
The breach also prompted Target to accelerate its adoption of chip-and-PIN (EMV) payment technology. The US retail industry as a whole accelerated its EMV migration timeline following the breach, with the 2015 liability shift deadline becoming a major industry milestone.
Financial and Legal Consequences
Target estimated the total cost of the breach at approximately $300 million over subsequent years, accounting for fraud costs, legal settlements, security upgrades, and operational changes. In May 2017, Target agreed to an $18.5 million settlement with the attorneys general of 47 states and the District of Columbia — one of the largest multi-state data breach settlements at the time.
A class action by financial institutions recovered $67 million. A separate consumer class action was settled for $10 million. Visa and MasterCard issued separate assessments against Target under their operating rules.
Industry Impact
The Target breach became a defining case study in third-party vendor risk management. It accelerated PCI DSS revisions regarding vendor access controls, network segmentation requirements, and the management of third-party credentials. It also catalysed industry adoption of chip payment cards and contributed to the 2015 EMV liability shift that pushed US merchants to upgrade payment terminals.
Verdict
Confirmed. The breach is documented in exhaustive detail across congressional testimony, court records, security research publications, and regulatory filings. The attack vector (stolen vendor credentials), the malware (BlackPOS), the timeline, the volume of stolen data, and the financial consequences are all matters of public record.
Evidence Filters10
HVAC vendor credentials used as initial access vector
SupportingStrongFazio Mechanical Services, a third-party HVAC contractor with remote network access to Target's systems, had its credentials stolen via a phishing email deploying the Citadel banking trojan. The stolen credentials provided the initial foothold into Target's network.
BlackPOS RAM-scraping malware installed on POS terminals
SupportingStrongBlackPOS (Kaptoxa) malware was deployed on a significant fraction of Target's 1,800 US store POS terminals, harvesting payment card data from system memory between swipe and encryption. The malware exfiltrated 40 million card numbers over 21 days.
FireEye alerts not acted upon
SupportingStrongTarget's FireEye intrusion detection system generated alerts during the malware installation phase. Those alerts were not escalated or acted upon. This failure of internal detection and response compounded the initial vendor-access vulnerability.
Brian Krebs disclosed breach publicly 18 December 2013
SupportingStrongJournalist Brian Krebs at KrebsOnSecurity.com was first to publicly report the breach, on 18 December 2013, based on banking industry sources who had observed a pattern of card fraud traced to Target purchases. Target confirmed the breach the same day.
CEO Gregg Steinhafel and CIO Beth Jacob both resigned within months
SupportingCIO Beth Jacob resigned in March 2014; CEO Gregg Steinhafel resigned on 5 May 2014. Both departures were attributed by the board and analysts to the breach and the company's handling of it. Steinhafel had been with Target for 35 years.
$18.5M state AG settlement and ~$300M total costs
SupportingStrongTarget reached an $18.5 million settlement with the attorneys general of 47 states in May 2017. Cumulative costs including fraud reimbursements, legal fees, security upgrades, and settlements were estimated at approximately $300 million over subsequent years.
Fazio's free Malwarebytes endpoint security — inadequacy question
NeutralReports indicated Fazio used a free version of Malwarebytes that did not include real-time protection as its primary endpoint security tool. Whether this directly caused the Citadel infection is debated; the adequacy of vendor security assessments by Target is a separate question.
Rebuttal
The Fazio credential theft was the proximate entry point, but the deeper failure was Target's network segmentation allowing a vendor portal with HVAC billing access to reach POS systems. Even a well-secured vendor should not have had that network path.
Industry-wide EMV acceleration and PCI DSS reforms followed
NeutralWeakThe Target breach accelerated the US payment card industry's EMV (chip-and-PIN) migration timeline and prompted revisions to PCI DSS third-party vendor access standards. The 2015 EMV liability shift became a direct industry response to lessons from Target and subsequent breaches.
HVAC Vendor Credential Compromise Was Supply-Chain Attack, Not Internal Corporate Concealment
NeutralThe Target breach began when attackers compromised credentials of Fazio Mechanical Services, Target's HVAC vendor, and used network access granted for electronic billing and project management to pivot to the point-of-sale environment. This attack vector — third-party vendor credential compromise — was a novel and sophisticated technique at the time, not a well-known risk that Target had deliberately ignored. The attack vector has since become a recognized supply-chain risk category and informed subsequent NIST and PCI DSS guidance.
CEO Resignation and PCI DSS Reforms Reflected Genuine Accountability
DebunkingTarget CEO Gregg Steinhafel resigned in May 2014 — a significant accountability event that corporations rarely accept voluntarily. The breach also accelerated US adoption of EMV chip-card standards and PCI DSS 3.0's enhanced third-party vendor security requirements. These outcomes reflect the accountability mechanisms working — reputational pressure forcing leadership change and industry standards reform — not a system designed to protect corporations from consequences of security failures.
Evidence Cited by Believers6
HVAC vendor credentials used as initial access vector
SupportingStrongFazio Mechanical Services, a third-party HVAC contractor with remote network access to Target's systems, had its credentials stolen via a phishing email deploying the Citadel banking trojan. The stolen credentials provided the initial foothold into Target's network.
BlackPOS RAM-scraping malware installed on POS terminals
SupportingStrongBlackPOS (Kaptoxa) malware was deployed on a significant fraction of Target's 1,800 US store POS terminals, harvesting payment card data from system memory between swipe and encryption. The malware exfiltrated 40 million card numbers over 21 days.
FireEye alerts not acted upon
SupportingStrongTarget's FireEye intrusion detection system generated alerts during the malware installation phase. Those alerts were not escalated or acted upon. This failure of internal detection and response compounded the initial vendor-access vulnerability.
Brian Krebs disclosed breach publicly 18 December 2013
SupportingStrongJournalist Brian Krebs at KrebsOnSecurity.com was first to publicly report the breach, on 18 December 2013, based on banking industry sources who had observed a pattern of card fraud traced to Target purchases. Target confirmed the breach the same day.
CEO Gregg Steinhafel and CIO Beth Jacob both resigned within months
SupportingCIO Beth Jacob resigned in March 2014; CEO Gregg Steinhafel resigned on 5 May 2014. Both departures were attributed by the board and analysts to the breach and the company's handling of it. Steinhafel had been with Target for 35 years.
$18.5M state AG settlement and ~$300M total costs
SupportingStrongTarget reached an $18.5 million settlement with the attorneys general of 47 states in May 2017. Cumulative costs including fraud reimbursements, legal fees, security upgrades, and settlements were estimated at approximately $300 million over subsequent years.
Counter-Evidence1
CEO Resignation and PCI DSS Reforms Reflected Genuine Accountability
DebunkingTarget CEO Gregg Steinhafel resigned in May 2014 — a significant accountability event that corporations rarely accept voluntarily. The breach also accelerated US adoption of EMV chip-card standards and PCI DSS 3.0's enhanced third-party vendor security requirements. These outcomes reflect the accountability mechanisms working — reputational pressure forcing leadership change and industry standards reform — not a system designed to protect corporations from consequences of security failures.
Neutral / Ambiguous3
Fazio's free Malwarebytes endpoint security — inadequacy question
NeutralReports indicated Fazio used a free version of Malwarebytes that did not include real-time protection as its primary endpoint security tool. Whether this directly caused the Citadel infection is debated; the adequacy of vendor security assessments by Target is a separate question.
Rebuttal
The Fazio credential theft was the proximate entry point, but the deeper failure was Target's network segmentation allowing a vendor portal with HVAC billing access to reach POS systems. Even a well-secured vendor should not have had that network path.
Industry-wide EMV acceleration and PCI DSS reforms followed
NeutralWeakThe Target breach accelerated the US payment card industry's EMV (chip-and-PIN) migration timeline and prompted revisions to PCI DSS third-party vendor access standards. The 2015 EMV liability shift became a direct industry response to lessons from Target and subsequent breaches.
HVAC Vendor Credential Compromise Was Supply-Chain Attack, Not Internal Corporate Concealment
NeutralThe Target breach began when attackers compromised credentials of Fazio Mechanical Services, Target's HVAC vendor, and used network access granted for electronic billing and project management to pivot to the point-of-sale environment. This attack vector — third-party vendor credential compromise — was a novel and sophisticated technique at the time, not a well-known risk that Target had deliberately ignored. The attack vector has since become a recognized supply-chain risk category and informed subsequent NIST and PCI DSS guidance.
Timeline
Fazio Mechanical credentials stolen via phishing
Attackers send a phishing email to employees of Fazio Mechanical Services, a Target HVAC contractor, deploying the Citadel banking trojan. Fazio's network credentials for Target's vendor portal are captured. Fazio reportedly uses a free version of Malwarebytes without real-time protection.
BlackPOS deployed on Target POS systems; Thanksgiving shopping begins
Using Fazio credentials, attackers access Target's network and deploy BlackPOS RAM-scraping malware on POS terminals across approximately 1,800 US stores. The Thanksgiving holiday shopping period — the highest-traffic retail period of the year — begins the same day. FireEye alerts are generated but not acted upon.
Brian Krebs discloses breach; Target confirms same day
KrebsOnSecurity publishes a report based on banking industry sources describing a major card breach traced to Target. Target confirms the breach the same day, disclosing 40 million compromised payment-card numbers. Target later reveals 70 million PII records were also stolen. The breach had already ended — 40 million cards were exfiltrated over 21 days.
Source →$18.5M multistate AG settlement reached; total costs ~$300M
Target reaches an $18.5 million settlement with 47 state attorneys general. Combined with prior class action and financial institution settlements, and the costs of security upgrades, legal fees, and fraud reimbursements, Target's total breach-related costs are estimated at approximately $300 million.
Verdict
Target's network was accessed via stolen credentials from HVAC vendor Fazio Mechanical Services. BlackPOS RAM-scraping malware captured 40M payment-card numbers and 70M PII records between 27 Nov and 18 Dec 2013. Brian Krebs broke the story 18 Dec 2013. CEO Gregg Steinhafel resigned May 2014; CIO Beth Jacob resigned March 2014. $18.5M state AG settlement May 2017. Total cost ~$300M. PCI DSS vendor-access reforms followed.
Frequently Asked Questions
How did attackers get into Target's network through an HVAC vendor?
Fazio Mechanical Services had been granted remote access to Target's network for billing and project management. Attackers stole Fazio's credentials via a phishing email deploying the Citadel banking trojan. The critical failure was that Target's network did not adequately segment the vendor portal from payment infrastructure — a path from an HVAC billing login to POS terminals should not have existed.
Did Target's security systems detect the breach?
Yes. Target's FireEye intrusion detection system generated alerts during the BlackPOS malware installation phase. Those alerts were not escalated or acted upon. Had the FireEye alerts been responded to, the breach could have been contained before substantial card data was exfiltrated. The failure of detection response compounded the initial access failure.
How did Brian Krebs find out about the breach before Target disclosed it?
Krebs received information from banking industry sources — card issuers and fraud analysts — who had identified a pattern of payment card fraud that traced back to purchases made at Target stores between late November and mid-December 2013. The banking sector often detects breaches at retailers before the affected company discloses them publicly, because card fraud patterns are visible to card issuers.
What was the long-term impact of the Target breach on the payment card industry?
Sources
Show 3 more sources
Further Reading
- articleTarget hackers broke in via HVAC company — KrebsOnSecurity — Brian Krebs (2014)
- paperSenate Commerce Committee hearing: data security at major retailers — US Senate Commerce Committee (2014)
- bookSpam Nation: The Inside Story of Organised Cybercrime — Brian Krebs (2014)