Target, 2013: 40 million cards, and the air-conditioning contractor

If you want one story that explains why every large company now runs a vendor security programme, this is it. The attackers who took 40 million card numbers out of Target during the 2013 Christmas shopping season did not start at Target. They started at a refrigeration contractor in Pennsylvania.

What happened

Fazio Mechanical Services supplied and maintained heating, ventilation and refrigeration systems for Target stores. Like many suppliers, it had a login to a Target-run web portal for billing, contracts and project management. In autumn 2013, someone sent Fazio a phishing email carrying a variant of Citadel, commodity password-stealing malware, sold openly on criminal forums. It worked, and the contractor's Target credentials went with it.

That portal was never meant to be a route into the store network. But the segmentation between the vendor-facing systems and the internal corporate network was not strong enough to keep an attacker out once they were inside with valid credentials, and from the corporate network the attackers found their way to the point-of-sale estate.

On 27 November 2013, the day before Thanksgiving and the start of the busiest shopping period of the American year, they pushed memory-scraping malware onto the tills.

How card scraping worked

Card data on a magnetic stripe is encrypted in transit and at rest. But at the moment the stripe is read, the terminal holds the track data in memory in the clear for a fraction of a second so it can process the transaction. That gap is what BlackPOS-family malware exists to exploit: it sits on the terminal, watches its own process memory for the pattern of a card track, and copies it out.

The stolen tracks were written to a file on an internal server, then moved out of the network in batches over the following two weeks, timed, according to the Senate committee's later analysis, to blend into normal business hours.

The timeline

1. Autumn 2013: Phishing malware steals Fazio Mechanical's Target portal credentials.
2. 15 November: Attackers are inside Target's network, testing their access.
3. 27 November: Card-scraping malware is live across the point-of-sale estate; capture begins.
4. 30 November: FireEye alerts fire and are not escalated.
5. 2–15 December: Stolen track data is exfiltrated in batches.
6. 12 December: The US Department of Justice notifies Target that card data traced to its stores is appearing on carding markets.
7. 15 December: Target removes the malware.
8. 18 December: Brian Krebs publishes the story. Target confirms the following day.
9. 10 January 2014: Target discloses the additional 70 million customer records.
10. March 2014: CIO Beth Jacob resigns. May 2014: Chief executive Gregg Steinhafel resigns.
11. May 2017: $18.5 million settlement with 47 states and the District of Columbia.

What it cost, and who paid

Target reported roughly $202 million in gross breach-related expenses across the following years, materially offset by insurance. Card issuers bore the cost of reissuing tens of millions of cards and recovered part of it through settlements with Visa and MasterCard. Consumers, in the main, were made whole on fraudulent transactions, card networks' liability rules are designed for exactly that, but spent the season cancelling cards and waiting for replacements.

The people who paid the highest personal price were the executives. A chief executive of a Fortune 50 retailer losing his job over an intrusion was new in 2014, and it is the reason the subject stopped being delegated downwards.

What it changed

Chip cards arrived in America. The United States had been an outlier: the rest of the developed world had moved to EMV chip cards years earlier, leaving the US magnetic stripe as the softest target on the planet. Target accelerated a rollout that was already planned, and the card networks brought forward the October 2015 liability shift that made whichever party had not adopted chip technology responsible for fraudulent transactions. Card-present fraud in the US fell sharply afterwards, and moved online, where it remains.

Vendor access became a controlled thing. Before Target, third-party portal accounts were plumbing. After it, they became an audited asset class: scoped credentials, network segmentation between vendor systems and everything else, and contractual security obligations that a refrigeration contractor is now expected to meet.

"We had alerts" stopped being a defence. The Senate committee's report walked through the intrusion as a kill chain and showed that Target had opportunities to break it at nearly every stage. That framing, where did detection exist, and why did it not produce a response, is now the standard shape of a post-incident review.

If you shopped there

The cards involved were reissued more than a decade ago, so the direct risk is long gone. The 70 million customer records, names, addresses, phone numbers, email addresses, are a different matter, because that information does not expire and has been folded into marketing and fraud datasets ever since.