Between November 27 and December 15, 2013, the busiest shopping weeks of the year, attackers stole the payment card details of about 40 million Target customers, along with personal information for up to 70 million people. The security journalist Brian Krebs broke the story on December 18. It became one of the defining breaches of the decade, and more than ten years later, its lessons keep needing to be relearned.
How it happened
1. The HVAC contractor. The attackers didn't start at Target. They started at Fazio Mechanical Services, a small Pennsylvania company that maintained refrigeration and HVAC systems for Target stores. Fazio was compromised, reportedly through an email that installed password-stealing malware, and the attackers took the credentials Fazio used to log into Target's vendor portal for billing and project management.
2. From the vendor portal to the network. Those credentials got the attackers onto Target's network. That's the first critical failure: a contractor's billing login shouldn't lead anywhere near payment systems, but Target's network wasn't segmented to stop it. The attackers moved from the vendor-facing systems deeper into the corporate network.
3. Malware on the registers. They installed a memory-scraping malware variant on Target's point-of-sale terminals. When a card was swiped, its data was briefly in the register's memory in plain text before being encrypted. The malware grabbed it there.
4. Staging and exfiltration. The stolen card data was collected on compromised internal servers and then sent out to servers the attackers controlled, from where it was sold in bulk on criminal card shops.
The alarms that went unanswered
Here's the part that turned a breach into a scandal. Target had invested in security. It had deployed FireEye malware detection, monitored by a security team in Bangalore. The system flagged the malware, and the Bangalore team escalated alerts to Target's security operations center in Minneapolis. The system also had an option to delete malware automatically, which had been switched off.
The alerts weren't acted on. Investigators later found that the attackers continued working for days after the first warnings. Target had the tools and the people. What it lacked was a process that turned an alert into a decision.
What it cost
- Leadership: Target's CIO resigned in March 2014, and its CEO, Gregg Steinhafel, resigned that May, the first time a breach was widely seen as ending a Fortune 500 chief executive's tenure.
- Money: Target reported about $290 million in breach-related expenses over the following years, including settlements of $10 million with consumers, $67 million with Visa, $39 million with banks and $18.5 million with 47 states.
- Sales and trust: Holiday sales and profits dropped sharply that quarter, and shoppers stayed wary for months.
What changed
- Chip cards. The US was one of the last major markets still relying on magnetic stripes. The breach added urgency to the move to EMV chip cards, and the card networks' liability shift took effect in October 2015.
- Third-party risk became a board-level topic. Vendor access reviews and questionnaires multiplied.
- Segmentation of payment systems, required by PCI DSS, was taken more seriously.
- Accountability. Boards started asking security questions, and chief information security officers started reporting to them.
What didn't change enough
The pattern, a third party's credentials leading to the crown jewels, keeps repeating:
- Change Healthcare, February 2024: stolen credentials on a remote access portal with no MFA, leading to a ransomware attack that disrupted US healthcare for weeks.
- Snowflake customers, this spring: stolen credentials, no MFA, and data from around 165 organizations taken.
Swap "HVAC vendor portal" for "remote access portal" or "cloud data platform" and it's the same story. The specific lessons, MFA on every external login, vendors limited to what they need, segmentation that assumes a breach, and alerts with an owner and a response time, are all still being learned the hard way. I covered most of them in the least privilege principle and zero trust.
Can it happen again?
It already has, many times. But the specific Target attack, swiping cards at a register, is much harder now, thanks to chip cards and contactless payments that never expose the real card number. Attackers moved on to online checkouts, cloud databases and ransomware. The lesson that transfers isn't about point-of-sale malware. It's that security tools are only as good as the process that responds to them.