The Target breach (2013)

What happened

In December 2013, the US retailer Target announced that attackers had stolen payment card data from customers who shopped in its US stores between late November and mid-December, the busiest shopping weeks of the year. The company said data from about 40 million credit and debit cards was taken. In January 2014 it added that personal information such as names, addresses, phone numbers and email addresses for up to 70 million customers had also been stolen, with some overlap between the two groups.

The breach became a landmark case because it showed how an attacker could move from a small supplier to the heart of a huge retail operation.

How it worked

Public investigations, including a US Senate committee staff report in 2014, described the broad chain of events:

1. A vendor's credentials were stolen. Attackers obtained login details belonging to a refrigeration and heating contractor that had access to a Target system used for billing and project management with suppliers. Reports indicated the contractor had been hit by a phishing email carrying malware.
2. From the vendor portal to the internal network. Using that foothold, the attackers worked their way deeper into Target's network. The network was not separated tightly enough to stop them reaching systems far from the supplier portal.
3. Malware on checkout terminals. They installed "RAM-scraping" malware on point-of-sale (POS) systems. When a card is swiped, its data is briefly present in the terminal's memory in readable form before it is encrypted for transmission. The malware copied the data from memory during that moment.
4. Collecting and sending out the data. Stolen card data was gathered on internal servers and then sent outside the company.

Investigations also reported that Target's security monitoring tools raised alerts during the intrusion, but those alerts were not acted on in time. That detail turned the breach into a lesson about process as much as technology.

Impact

Banks reissued millions of cards, and stolen numbers appeared for sale on criminal marketplaces. Target's chief executive and chief information officer left the company in 2014. The company faced lawsuits from customers, banks and card brands, and in 2017 it reached an $18.5 million settlement with 47 US states and the District of Columbia, on top of other settlements. The breach also put payment security on the agenda of company boards across retail.

What defenders learned

• Vendors are part of your attack surface. Third parties should only reach the systems they need, with strong authentication. See vendor and supply-chain risk.
• Network segmentation matters. Payment systems should be walled off from the rest of the network, so a break-in elsewhere cannot reach them.
• Alerts need owners. Detection tools only help if someone investigates and acts on what they find.
• Chip cards reduce counterfeit fraud. The breach added momentum to the US shift to EMV chip cards, with the card brands moving fraud liability toward businesses without chip-capable terminals in October 2015.

What it means for you

As a shopper, you could not have stopped this breach, but you can limit its effect:

• Use credit cards rather than debit cards for in-store shopping where possible, since fraudulent charges do not drain your bank account while they are disputed.
• Turn on transaction alerts in your banking app so you see charges as they happen.
• Use contactless payment or mobile wallets, which send a one-time token instead of your real card number.
• Be alert to phishing after a breach. Criminals often send fake "your card was compromised" messages to exploit the news.

If you run a business that takes cards, read our plain-language PCI guide.