☰Series Navigation (13 parts)
Every article in this series so far has involved a nation.
The United States, Israel, Russia, intelligence agencies with billion-dollar budgets and years to spend. It would be easy to file the whole subject under “problems for governments” and move on. This article exists to close that exit, because the same attack that took down a nuclear plant and the U.S. Treasury also took down a store’s cash registers, and it got in through the heating guy.
Target is the article in this series I’d put in front of every executive I know. Forty million card numbers walked out the door through a heating contractor’s login, a flat network and ignored alerts, and I’d bet most companies reading this have all three problems right now.
What was the Target breach?
In late 2013, during the Christmas shopping rush, attackers installed malicious software on the checkout systems in Target stores across the country. As customers swiped their cards to pay, the malware scraped the card data straight out of the register’s memory and sent it out to be collected and sold. By the time it was stopped, the attackers had compromised around 40 million payment cards, along with personal information, names, addresses, phone numbers, emails, for as many as 70 million people.
The fallout was enormous. Banks reissued millions of cards. Target faced a wave of lawsuits and a bill that ran well past a hundred million dollars once settlements and response costs were counted. Both the CEO and the chief information officer eventually lost their jobs. For a while, Target was the public face of the corporate data breach, the cautionary tale every board in America suddenly wanted to understand.
The executives lost their jobs, and that comes with the chair. The shoppers are the ones I think about. They handed over a card to buy holiday gifts and ended up disputing charges and waiting on replacement cards, for a risk nobody ever told them they were taking.
And the way in had nothing to do with cash registers.
How did attackers get into Target through an HVAC company?
Every link in this chain is ordinary, and that’s what I’d want every person who signs vendor contracts to understand.
Target, like every large company, works with outside vendors, and it gives some of them limited access to its systems to do their jobs.
One of those vendors was Fazio Mechanical Services, a small heating, ventilation, and air conditioning contractor in Pennsylvania. Fazio had legitimate access to a Target vendor portal for the boring business of billing, contracts, and project management. There’s nothing unusual about that. Refrigeration and climate control matter to a retailer, and the contractor needs a way to submit invoices and coordinate work.
The attackers started with Fazio. They sent the contractor a phishing email carrying password-stealing malware, and it worked, reportedly in part because the small company was relying on a free consumer antivirus tool not meant for business protection. With that malware in place, the attackers harvested Fazio’s login credentials for the Target vendor portal.
A small HVAC shop running free antivirus is doing what small shops do. The failure belongs to the retailer that let that shop’s login lead anywhere near the payment systems and never asked what was protecting it. I’d hold the company with the security budget to a much higher standard than the contractor who fixes its refrigeration.
Now they had a legitimate way into Target’s network, wearing the identity of a trusted vendor. From that vendor portal, they worked their way deeper, moving from the system meant for contractors into Target’s internal network, escalating their access until they could reach the systems that ran the point-of-sale registers. Then they pushed their card-scraping malware out to those registers across nearly 1,800 stores and started collecting.
Read that path again. The people who serviced the air conditioning became the road to the credit card numbers of 40 million shoppers. Nobody at Target decided to give the HVAC contractor access to the cash registers. They gave the contractor access to a billing portal, and the network was built so that a foothold in one corner could be walked, step by step, all the way to the most sensitive systems in the company.
Why is a vendor with limited access still a serious risk?
Because access isn’t the boundary people imagine it is, and this is the lesson I spent years trying to get across in real companies.
When you grant a vendor limited access, you picture a small, contained room.
What you opened is a door into your building, and what matters isn’t the size of the room behind that door but whether someone who gets through it can then move into the rest of the building. At Target, the door for a billing portal turned out to connect, through a series of steps, to the payment systems. The access granted was narrow. The access achievable was not.
And here’s the thread that ties Target to Crypto AG and the Hezbollah pagers and every poisoned update in this series: you inherit your vendor’s security. Fazio Mechanical was a small contractor that had every reason to focus on refrigeration and no particular reason to run an enterprise-grade security program.
The moment Target connected its network to Fazio’s, Fazio’s weaker security became part of Target’s attack surface. Target could have the best defenses in retail and it wouldn’t matter, because the attacker didn’t attack Target’s defenses. It attacked the heating company and walked in through a door Target had opened on purpose.
Every organization has a Fazio. The cleaning service with a login to the building system.
The small software vendor whose tool runs on your servers. The marketing agency with access to your customer list. The bookkeeper with the keys to the finances. Each one is a door, and each one comes with that vendor’s security posture attached, whether you’ve ever looked at it or not.
Target’s alarms went off. Why didn’t it matter?
The Target story is outrageous because the company had already paid for the answer.
Target wasn’t defenseless. It had spent money on a serious threat-detection system, and the system worked. When the attackers’ malware went active, the system generated alerts. It saw the thing happening and it said so. The alarms fired.
Nobody acted on them. The warnings were generated and, by the accounts that followed, investigated and then not escalated to anyone who stopped the attack. For roughly three weeks, card data poured out of Target’s registers while the alerts that could have ended it sat unaddressed. In the end, Target didn’t catch the breach through its own response at all. An outside payment processor noticed fraud patterns and came to Target, weeks into the theft.
I spent twenty years in operations, and this is the failure that I find least forgivable and most common. Detection without response is theater. An alarm that no one answers is worse than no alarm, because it lets you believe you’re protected while the building burns.
Companies love buying tools because it feels like action, and buying one is easy. Nobody wants to fund the boring human machinery of watching the alerts, knowing what they mean, and having a plan for what to do when one fires at two in the morning. Target had the smoke detector. It had disconnected the part where somebody calls the fire department.
My friend Sixto Bernal built his whole philosophy on this. Executives treat cybersecurity as a cost center, money spent and gone. Sixto argues it pays back far more than it costs, because it prevents the incidents, the lawsuits and the damage to a company’s reputation. Target proved his point the expensive way. His own company never bought the argument, and I think most executives miss it because they don’t understand security well enough to see it.
What should any organization take from the Target breach?
Three things, and they cost attention more than money.
Map your vendors as attack surface, the way an attacker sees them, instead of only as business relationships.
Every outside party with any access to your systems is a potential path in, and their security is now your security. You need to know who they are, what they can reach, and how seriously they take their own defense. Most organizations can’t even produce a complete list. That gap is the first problem.
Segment your network so a foothold isn’t a conquest.
The reason a billing portal reached the cash registers is that the path existed. Systems that don’t need to talk to each other shouldn’t be able to, so that an attacker who gets into one corner is trapped there instead of free to roam. This is a design decision made on a calm day, and it limits how far an incident can spread.
Fund the response as well as the detection. An alert nobody answers bought you nothing. If you’re going to spend on tools that watch for intruders, you have to spend at least as much on the people and the plans that turn an alert into an action. The alarm is the cheap part. Answering it is the job.
The most damning thing about Target is how ordinary every mistake was. A contractor with weak protection, a network nobody segmented and alarms nobody answered are sitting inside thousands of companies today, run by executives who think this story belongs to somebody else. I’d tell every one of them to pull their vendor list and their alert history this week, before an outside company calls to tell them what their own alarms already said.
The next article is the strangest one in this series: a backdoor that a single volunteer spent two years earning the trust to plant in software running on much of the internet, caught by pure luck days before it spread. For the wider view of security and the executives and writers who need to understand it, the cybersecurity hub collects the rest of my work on this.
