Target 2013 Data Breach

Background

Target Corporation, one of the largest retail chains in the United States, operated point-of-sale (POS) terminals across nearly all of its roughly 1,800 U.S. stores. In late 2013, during the critical Black Friday and holiday shopping season, attackers infiltrated Target's internal network and ultimately deployed malicious software onto the company's POS card-reading systems, enabling large-scale theft of customer payment card data.

Initial Intrusion

Investigators determined that the attackers first gained a foothold in Target's network on or around November 15, 2013, using network credentials that had been stolen from Fazio Mechanical Services, a Pennsylvania-based heating, ventilation, and air conditioning (HVAC) contractor that did business with Target. Fazio had legitimate remote access to a Target vendor portal used for functions such as electronic billing, contract submission, and project management. Investigators and security researchers, including journalist Brian Krebs who first reported the breach, concluded that inadequate segmentation between this vendor-facing network and Target's payment card environment allowed the intruders to pivot from the vendor portal into systems that touched point-of-sale infrastructure.

Malware Deployment and Data Theft

Between mid-November and Thanksgiving 2013, the attackers tested POS malware, widely identified as a variant of BlackPOS (also called Kaptoxa), on a limited number of registers. Within days of successful testing, the malware was pushed out to the large majority of Target's payment terminals. The malware captured card data directly from a register's memory as cards were swiped, a technique known as RAM scraping, before the data could be encrypted. Target has stated that the compromise of payment systems occurred between November 27 and December 15, 2013. Stolen card data was periodically moved to internal staging servers within Target's network and then exfiltrated to external "drop" servers located in the United States and abroad, from which it was retrieved by the perpetrators.

Disclosure and Scope

Brian Krebs first reported on the breach on December 18, 2013, citing sources at major card issuers who had detected a pattern of fraud traceable to Target purchases. Target publicly confirmed the breach on December 19, 2013, stating that approximately 40 million credit and debit card accounts may have been affected. On December 27, 2013, Target disclosed that encrypted PIN data had also been compromised. On January 10, 2014, the company further disclosed that personal information—including names, mailing addresses, phone numbers, and email addresses—of up to 70 million customers had been exposed, with some overlap between the two affected groups.

Corporate and Regulatory Response

The breach triggered a sharp decline in Target's holiday sales and profits, congressional hearings on retail data security, and investigations by the U.S. Secret Service and state attorneys general. Target's Chief Information Officer, Beth Jacob, resigned in March 2014, and CEO Gregg Steinhafel resigned in May 2014, with the breach cited as a contributing factor. Target offered affected customers free credit monitoring and identity-theft protection. In 2015, Target agreed to pay $67 million to Visa card issuers and reached a $39 million settlement with a group of banks over card-reissuance costs. In May 2017, Target agreed to pay $18.5 million to settle a multistate investigation led by a coalition of 47 state attorneys general and the District of Columbia, at the time the largest multistate data breach settlement in U.S. history, and agreed to implement stronger data security practices.

Significance and Legacy

The Target breach is frequently cited alongside the earlier TJX and Heartland Payment Systems breaches as a landmark event in the history of large-scale payment card theft. Its exposure of third-party vendor risk as an attack vector, combined with the scale of the compromise, is widely credited with accelerating the U.S. payments industry's shift toward EMV chip card technology and prompting many large retailers to reassess network segmentation and vendor access policies as part of PCI-DSS compliance efforts.

Timeline

• 2013-11-15Attackers gain initial access to Target's network using network credentials stolen from HVAC vendor Fazio Mechanical Services.
• 2013-11-15POS malware is tested on a small number of Target payment terminals.
• 2013-11-27Malware becomes fully operational across most Target POS systems, beginning mass card-data theft over the Thanksgiving/Black Friday period.
• 2013-12-15Target removes the malware from its point-of-sale systems, ending the active data-theft window.
• 2013-12-18Journalist Brian Krebs publicly reports the breach based on sources at card-issuing banks.
• 2013-12-19Target publicly confirms the breach, stating about 40 million payment card accounts may have been affected.
• 2013-12-27Target discloses that encrypted PIN data was also compromised.
• 2014-01-10Target discloses that personal information of up to 70 million customers was exposed, in addition to the card data.
• 2014-03-05Target Chief Information Officer Beth Jacob resigns.
• 2014-05-05Target CEO Gregg Steinhafel resigns.
• 2015Target reaches settlements of $67 million with Visa issuers and $39 million with a group of banks over card-reissuance costs.
• 2017-05Target agrees to pay $18.5 million to settle a multistate investigation by 47 state attorneys general and the District of Columbia.