The Target Breach of 2013: How a Heating Contractor Opened the Door

During the 2013 holiday shopping season, attackers installed malware on payment terminals across the US retailer Target and captured card data from shoppers for several weeks. The company announced the breach on 19 December 2013. One detail attracted particular attention: investigators reported that the attackers got in using credentials stolen from a refrigeration and heating contractor that worked with Target.

What was stolen

Target said that information from about 40 million credit and debit cards had been taken from transactions made in its US stores between late November and mid-December 2013. In January 2014 it added that personal details, including names, postal addresses, phone numbers and email addresses, had been taken for as many as 70 million customers. Some of these customers overlapped with the card victims. It was one of the largest retail breaches to that date.

How the attackers got in

Reporting on the investigation, including by security journalist Brian Krebs and later by US Senate committee analysis, described a chain of events:

1. Attackers reportedly sent a phishing email to a small company, Fazio Mechanical Services, that provided refrigeration and HVAC services to Target stores, and stole its login details for a Target vendor portal.
2. Using those credentials, they gained a foothold in Target's network. The vendor system was meant for billing and project management, not for reaching the stores' payment systems.
3. From there, they moved across the network to the point-of-sale systems and installed malware that copied card details from memory as cards were swiped.
4. They collected the stolen data on internal servers and then transferred it out of the network.

The alarms that were not acted on

Target had installed a malware detection product from the security firm FireEye, and press reports said that it raised alerts as the malware was loaded. Those alerts were not acted on in time. The data theft therefore continued until the US Department of Justice told Target about the stolen cards in mid-December 2013. This part of the story is a classic: tools gave a warning, but the process for responding to the warning failed.

The fallout

The consequences were broad. Target reported a drop in sales and profit in the period afterwards, and it faced lawsuits from consumers and financial institutions. The company's chief information officer resigned in March 2014, and its chief executive, Gregg Steinhafel, left in May 2014. In 2017 Target agreed to pay 18.5 million dollars to settle an investigation by attorneys general in 47 states and the District of Columbia. The breach also accelerated the US retail industry's move to chip-based cards.

Third-party risk in one table

Question	Why it matters
Which suppliers can log in to our systems?	Each one is a possible way in if their own security is weak.
What can their accounts actually reach?	Access should be limited to what the supplier needs and no more.
Do they use two-factor authentication?	It would have made a stolen password much less useful.
Who looks at alerts and what do they do?	A warning is useful only if someone responds in time.

Small businesses have suppliers too

Your web designer, your marketing agency, your freelance developer and the plugin vendors whose code runs on your site all have some level of access to your business. Many of them are small companies with limited security resources, much like the contractor at the centre of this story. If any of their accounts are stolen, the attacker inherits whatever you have granted them.

What changed in the industry

Target moved faster than many other US retailers to introduce chip-and-PIN style cards after the breach, and the incident became a reference point in boardrooms. It was one of the cases that persuaded companies to treat their vendors as an extension of their own network, with contract clauses, security questionnaires and tighter technical controls on what suppliers can reach. Cyber insurance, which was a niche product at the time, also grew sharply in popularity as executives realised how costly a single incident could be.

It also raised the profile of network segmentation. Segmentation means dividing a network into zones so that a problem in one place cannot spread to the rest. In Target's case, a billing portal for contractors should never have been a stepping stone to the cash registers. The same principle applies on a smaller scale to a hosting account: each website should be isolated from the others, so a compromised blog cannot read your shop's database.

The practical lesson for site owners

Give every person who helps with your site their own account, with only the permissions they need, and remove it when the work ends. Turn on two-factor authentication wherever it is offered, keep payment pages with a specialised payment provider and make sure someone is responsible for reading the warnings your systems produce. Review the list of users on your hosting panel, CMS and domain registrar at least twice a year.

Our security page describes the account protections available with our hosting, and agencies that manage many clients can look at our reseller hosting, which keeps each customer's site in a separate account.