How the Target breach happened: a vendor's billing login and the alarms nobody answered

The biggest retail breach of 2013 did not start at a cash register. It started with a login that belonged to a small heating and refrigeration contractor, and it ended with about 40 million payment cards and up to 70 million customer records in criminal hands.^[1][4] This case file covers how thieves got from a vendor's billing login to the checkout lanes, the alarms that went off, what it cost, and the one missing control.

What happened

How they got in

The contractor was not running Target's air conditioning remotely. It said publicly that its connection was used only for electronic billing, contract submission and project management.^[2] That is exactly the point. A low-privilege supplier login, meant for sending invoices, turned out to be a door into the same network that eventually reached the registers.

The Senate staff report walks through the attack in stages and finds a weak spot at almost every one. Two-factor authentication (a second proof of identity, such as a code on a phone) was rarely required for lower-level contractors. Once inside, the attackers apparently benefited from a default account password that had never been changed. Most importantly, the network was not divided tightly enough to stop someone who came in through the vendor side from moving to the systems that handle payment cards.^[1]

At the checkout lanes, the malware grabbed card numbers from the terminals' memory in the brief moment before they were encrypted and sent onward. The stolen data was gathered inside Target's network, then shipped out to servers in several countries, including Russia, during ordinary business hours when heavy traffic helped it blend in. Staff put the haul at about 11 GB.^[1]

How it was caught and what it cost

The painful part of this story is that Target's defenses did notice. The company had invested in malware-detection tools, and according to the Senate staff analysis, they raised automated alerts when the data-theft malware was installed in early December, including details of where the data was being sent. Antivirus software had also flagged suspicious activity on November 28. The report found that those warnings were not acted on in time, and that the theft continued until outside investigators called.^[1] Target had also been certified as meeting the payment card industry's security standard in September 2013, a reminder that passing an audit is not the same as being watched.^[1]

The bills arrived for years. In 2015 Target agreed to a $10 million settlement with consumers, a $67 million settlement with Visa and about $39 million with banks and credit unions that had to reissue cards, bringing publicly reported settlements to roughly $116 million by the end of that year.^[5] In May 2017 it agreed to pay $18.5 million to 47 states and the District of Columbia. That deal also required Target to hire an executive to run its security program, bring in independent assessors, and keep its cardholder data environment segmented from the rest of its network.^[6]

The missing control

The missing control: vendor access segmented from payment systems.

A supplier who needs to submit invoices should land in a small, walled-off area that can reach the billing portal and nothing else. If the contractor's stolen login had been limited to that corner, the attackers would have been standing in a closet with a filing cabinet, not in a hallway that led to every cash register in the country. The Senate staff named weak segmentation as the failure that let the intrusion cross from vendor access to payment systems, and the state attorneys general later wrote segmentation into Target's settlement.^[1][6] It would not have stopped the phishing, but it would have made the stolen password nearly worthless.

What to do in your business

• List every outside login. Write down every vendor, contractor, IT provider and software company that can sign in to your systems, and what each one can actually reach. Remove any account nobody can explain.
• Put payments on their own network. Ask your IT provider or card processor to keep card terminals and point-of-sale gear on a separate network (or at least a separate Wi-Fi and VLAN, a virtual network divider) from office PCs, guest Wi-Fi and anything a vendor touches.
• Require a second factor for remote access. Turn on two-factor authentication for every remote or vendor login, including the "small" ones for billing and scheduling.
• Change default passwords. Check routers, cameras, card terminals and management software for factory or default passwords and replace them.
• Make sure alerts reach a person. Decide who reads security warnings from your antivirus, firewall or managed IT provider, how fast they must respond, and who they call. An alert that nobody reads is just a log file.

Facts are drawn from court records, government reports and reputable reporting, listed below. People are named only where they were convicted or spoke publicly in an official role.