Target 2013: the theft of 40 million cards via an HVAC vendor

It was the early hours of Black Friday 2013. Target's US stores were gearing up for the biggest sales day of the year. While customers slept, data from 40 million credit and debit cards quietly traveled to servers in Eastern Europe. The intrusion had already been running for two weeks — and the company's security system had raised alerts days earlier. Nobody acted.

What Target looked like in 2013

Target Corporation was the second-largest retail chain in the US, with more than 1,800 stores and annual revenue near $70 billion. The company had an active security team and used sophisticated tools — including FireEye for malware detection. The breach didn't happen for lack of investment. It happened from a combination of poorly segmented third-party access and ignored alerts — a lesson the industry is still learning the hard way.

The way in: the HVAC contractor

The attackers didn't breach Target's systems directly. They started with Fazio Mechanical Services, a Pennsylvania refrigeration and air-conditioning company that provided maintenance services to the stores. Fazio had legitimate remote access to Target's network for billing and refrigerator temperature monitoring.

In October 2013, the attackers sent phishing emails to Fazio employees. At least one clicked and installed malware that captured the credentials for VPN access to Target's system. With a username and password in hand, they walked in through the back door: the vendor portal.

The critical failure came next: there was no network segmentation between the vendor portal and the internal payment systems. Once inside Fazio's portal, the attackers moved laterally to the stores' point-of-sale (POS) systems. That movement — from a low-privilege network into critical systems — is exactly what social engineering combined with a lack of network isolation makes possible.

BlackPOS: the malware that read cards from RAM

How exactly did BlackPOS work?

BlackPOS was a RAM scraper: it monitored POS terminal memory in real time and captured card data at the one moment it appears in plain text — during transaction processing, before the terminal encrypts it.

Magnetic-stripe data (track 1 and track 2) has to be read in the clear by the terminal to authorize the purchase. In that millisecond window, the malware swept through RAM, extracted the card number, expiration date and service code, and wrote it all to local files. Periodically, those files were sent via FTP to intermediary servers in Fargo, North Dakota, and from there to final servers in Eastern Europe.

The timeline was precise:

• November 15–28: attackers installed BlackPOS on an initial set of terminals.
• November 30: most of Target's registers were compromised.
• Nov. 27 – Dec. 15: 40 million card numbers captured.

Beyond the card data, the attackers also accessed a separate database with personal information for 70 million customers — names, addresses, phone numbers and emails.

The alerts nobody treated as a priority

FireEye identified the malware and issued alerts. It flagged five different BlackPOS variants and the addresses of the staging servers the attackers used. The security team in Bangalore received the notifications and passed them on to Minneapolis. No action was taken.

This phenomenon — alert fatigue — is a real problem in corporate environments. Overloaded teams get hundreds of alerts a day; many are false positives. Over time, the reflex to ignore or postpone triage sets in. In Target's case, that reflex cost hundreds of millions of dollars.

The US Department of Justice only notified Target on December 12, 2013 — after investigators seized servers holding the stolen data and connected the dots with reports of card fraud. According to Krebs on Security, the first outlet to break the story, the company took several days to confirm the breach publicly.

The cost of the breach

The final numbers are heavy. Target recorded breach-related costs of $292 million before insurance recoveries — or around $202 million net. The company settled for $18.5 million with 47 US states. CEO Gregg Steinhafel and the CIO left the company. Holiday-quarter sales dropped; the brand's reputation took years to recover.

For scale: the 2017 Equifax breach exposed 147 million people over a patch that went unapplied for months. Different vectors, same conclusion: breaches of this magnitude rarely have a single cause — they're chains of predictable failures nobody treated as urgent.

The legacy: what changed after 2013

The Target breach didn't create new defensive technologies, but it forced conversations that had previously stayed out of the boardroom. Vendor security became a board-level topic. The migration to the EMV standard (chip cards) — which makes RAM scraping far less effective because the data travels encrypted — gained urgency in the US, one of the few developed countries still dependent on magnetic stripes.

It also accelerated discussions about network segmentation as a baseline requirement for any third-party access. That point resurfaced in 2021 with the Colonial Pipeline attack, where credentials from a legacy VPN account without MFA opened the door for the DarkSide ransomware — and paralyzed fuel supply on the US East Coast for days.

The lesson stays the same: treating vendor access as internal access is an architectural decision that eventually comes due. Auditing what every third-party account can reach — and explicitly isolating what it doesn't need to reach — is the bare minimum expected of any company that processes payments at scale.

For the practical side of defense, the post on how to protect remote access on Windows covers the same isolation and authentication principles applied to RDP — today's most common vector for unauthorized access into corporate networks.