Anatomy of a Breach

Anatomy of a Breach: Target — 110 Million Customers Compromised Through an HVAC Contractor

> series: anatomy_of_a_breach —— part: 059 —— target: target_corporation —— customers: 110,000,000 —— entry: hvac_contractor<span class="cursor-blink">_</span>_

Hedgehog Security 30 November 2013 14 min read

110 million customers. Entry point: the air conditioning company.

On 19 December 2013 — in the middle of the peak holiday shopping season — Target Corporation disclosed that attackers had stolen payment card data from approximately 40 million customers who had used their cards at Target stores between 27 November and 15 December 2013. In January 2014, Target revealed that personal information — names, addresses, phone numbers, and email addresses — for an additional 70 million customers had also been compromised. The total: 110 million individuals affected.

The entry point was not a vulnerability in Target's own systems — it was stolen credentials from Fazio Mechanical Services, a small HVAC (heating, ventilation, and air conditioning) contractor that had network access to Target for electronic billing and project management. The attackers compromised Fazio through a phishing email, stole their Target network credentials, used those credentials to access Target's network, moved laterally from the contractor portal to the point-of-sale environment, and installed card-skimming malware on POS terminals across 1,797 Target stores. The breach cost Target over $300 million in total — and its CEO and CIO both lost their jobs.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

From HVAC contractor to 1,797 point-of-sale terminals.

Target Breach — Attack Chain
── Supply Chain Entry ──────────────────────────────────────
Fazio Mechanical (HVAC contractor) phished
Fazio's Target network credentials stolen
Fazio had access for billing and project management

── Network Pivot ───────────────────────────────────────────
Attackers use Fazio credentials to access Target network
Lateral movement from contractor segment to POS network
Insufficient segmentation between contractor and POS

── POS Malware Deployment ──────────────────────────────────
Card-skimming malware installed on POS terminals
Deployed across 1,797 Target stores nationwide
Captured card data during transaction processing

── Exfiltration ────────────────────────────────────────────
Stolen card data staged on compromised internal servers
Data exfiltrated to external servers
FireEye alerts were generated but not actioned

── Discovery ──────────────────────────────────────────────
DOJ notifies Target on 12 December 2013
Target confirms breach and discloses 19 December
Total impact: 110 million customers, $300M+ cost

Your HVAC contractor has your network credentials.

The Target breach is the definitive case study for supply chain risk through third-party vendor access. Fazio Mechanical was a small HVAC company with no dedicated IT security capability. They had been phished through a malicious email — a threat they were not trained or equipped to defend against. Yet they had credentials that provided network access to one of the largest retailers in the United States. The gap between Fazio's security posture and the sensitivity of the access they held was the vulnerability that the attackers exploited.

Third-Party Access Is Your Attack Surface
Every contractor, vendor, and supplier with access to your network is an extension of your attack surface. The <a href="/blog/anatomy-of-a-breach-rsa-securid">RSA→Lockheed</a> cascade was the first major supply chain attack in this series; Target proved that the supply chain includes not just technology vendors but HVAC companies, cleaning firms, and anyone with network credentials. Our <a href="/blog/sector-under-the-microscope-construction">construction</a> and <a href="/blog/sector-under-the-microscope-retail">retail sector analyses</a> examine vendor access risks.
No Segmentation Between Contractors and POS
The attackers moved from the contractor access portal to the POS environment without encountering adequate segmentation. An HVAC contractor's billing access should never share a network path with payment processing terminals. Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> validates segmentation between contractor access and sensitive systems.
Alerts Generated but Not Actioned
Target had deployed FireEye monitoring that generated alerts about the malware installation — but the alerts were not actioned. Having monitoring tools is not the same as having monitoring capability. <a href="https://www.socinabox.co.uk">SOC in a Box</a> provides 24/7 human-monitored detection — alerts are investigated, not just logged.
MFA Would Have Stopped the Initial Access
The attackers used stolen username/password credentials to access Target's network. MFA on the contractor portal would have prevented the stolen credentials from being usable. <a href="/cyber-essentials">Cyber Essentials Danzell</a> mandates MFA — a control that would have stopped the Target breach at step one.

The $300 million HVAC bill that every retailer should study.

The Target breach cost over $300 million, terminated the careers of the CEO and CIO, and permanently changed how the retail industry thinks about vendor access, network segmentation, and point-of-sale security. For UK retailers covered in our retail sector analysis, the lessons are directly applicable: assess vendor access, segment your network, deploy MFA, monitor your POS environment, and test your defences before attackers test them for you.

Our penetration testing validates vendor segmentation. PCI DSS testing assesses payment security. Cyber Essentials mandates MFA and access controls. SOC in a Box for Retail monitors for POS malware and anomalous data flows. And UK Cyber Defence provides incident response when a breach is detected.


Target's HVAC contractor cost them $300 million. Who has access to your network?

Our <a href="/penetration-testing/infrastructure">penetration testing</a> maps vendor access and tests segmentation. <a href="/cyber-essentials">Cyber Essentials</a> mandates MFA. <a href="https://www.socinabox.co.uk/sectors/retailers">SOC in a Box for Retail</a> monitors for POS compromise.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles