2013 Target data breach

2013 Target data breach
The original uploader was Hayfordoleary at English Wikipedia. · Public domain · source
Title	2013 Target data breach
Date	November–December 2013
Location	Minneapolis, Minnesota, United States
Type	Data theft, cybercrime
Affected	Customers of Target Corporation
Perpetrators	Identified as Carbanak-style attackers linked to cybercriminal groups
Outcome	Large-scale payment card and personal information compromise, regulatory settlements

2013 Target data breach The 2013 Target data breach was a major cybersecurity incident at Target Corporation that exposed millions of payment card records and personal data. The incident prompted investigations by federal agencies such as the Federal Bureau of Investigation, scrutiny from lawmakers including members of the United States Congress, and reforms affecting Visa, MasterCard, and retail cybersecurity practices. The breach influenced responses by corporations like Walmart, Best Buy, and Kroger and became a case study referenced by National Institute of Standards and Technology, Verizon, and academic centers including Carnegie Mellon University.

Background

Target, headquartered in Minneapolis, operated a national chain with executives such as then-CEO Gregg Steinhafel and Chief Information Officer Beth Jacob. Target had adopted payment processing technologies shared with retailers like Kroger and Sears and participated in industry groups such as the Retail Industry Leaders Association and standards organizations including Payment Card Industry Security Standards Council. Payment networks involved included Visa, MasterCard, American Express, and Discover Financial Services. Prior incidents involving retailers such as TJX Companies and Heartland Payment Systems provided context for vulnerabilities highlighted by security firms like Symantec, McAfee, FireEye, and Kaspersky Lab.

Breach timeline

In late November 2013, shoppers at Target stores during the Black Friday weekend began experiencing fraudulent charges linked to purchases at Target locations. Target announced a breach on December 19, 2013, prompting statements from state attorneys general including officials from California, New York, Texas, and Massachusetts. The Federal Trade Commission and the United States Secret Service opened investigations alongside the FBI. Media coverage by The New York Times, The Wall Street Journal, Bloomberg, CNN, and USA Today tracked developments as companies such as Trustwave and Neiman Marcus reviewed their defenses. Congressional hearings led by committees such as the United States Senate Committee on Commerce, Science, and Transportation featured testimony from Target executives and witnesses from Bank of America, JPMorgan Chase, and Wells Fargo.

Method and scope

Attackers used credentials stolen from a third-party vendor, Fazio Mechanical Services, to access Target’s network—parallels were drawn to techniques seen in operations attributed to groups linked to Eastern European cybercriminal syndicates and malware families like BlackPOS (also called Kaptoxa in some reports). Compromised point-of-sale systems running software from vendors such as Oracle and Microsoft were targeted during high-volume shopping periods. Malware exfiltrated track data from magnetic stripe cards processed through processors including First Data and TSYS before distribution via servers in locations linked to entities investigated by Interpol and Europol. Forensic analysis by firms like Mandiant and Trustwave Spiderlabs estimated millions of card numbers and personal records were stolen, echoing previous compromises of CardSystems Solutions and Heartland Payment Systems.

Impact and consequences

Estimates of affected payment cards varied, with banks such as Target Corporation’s acquiring partners and issuers including Chase Bank, Citibank, and Capital One reporting fraud. Consumers experienced unauthorized charges; retail peers such as Walgreens, Costco, and Sears Holdings Corporation reviewed POS security. Target’s market value and investor confidence were affected, drawing attention from shareholders represented by firms such as BlackRock and Vanguard Group. The breach influenced cybersecurity insurance providers like Aon and Marsh & McLennan Companies in assessing liability. Academic analyses from Massachusetts Institute of Technology, Stanford University, and University of California, Berkeley examined risk models, while trade publications like Wired, InformationWeek, and Dark Reading dissected technical and managerial failures.

Response and remediation

Target hired security firms including FireEye and consulting firms such as Deloitte and PwC to assist investigations and remediation. The retailer accelerated deployment of EMV chip-and-PIN technology used in countries like United Kingdom, Canada, and Australia and partnered with payment networks Visa and MasterCard for tokenization pilots. Target offered identity protection and credit monitoring through vendors like Experian and Equifax and cooperated with law enforcement. Corporate governance changes included the resignation of CEO Gregg Steinhafel and board-level reviews involving directors with experience at General Electric and Procter & Gamble.

Legal and regulatory outcomes

Target faced class-action lawsuits led by law firms representing affected consumers and banks; settlements involved state attorneys general from jurisdictions including New York, California, and Massachusetts. The company agreed to settlements and fines coordinated with the Federal Trade Commission and engaged in arbitration and litigation involving payment brands Visa and MasterCard and processors like First Data Corporation. Congressional hearings prompted proposed legislation discussed by members of the United States House of Representatives and United States Senate on data breach notification and payment security standards. The breach influenced rulemaking at the Payment Card Industry Security Standards Council and oversight activities by the Consumer Financial Protection Bureau.

Lessons and industry changes

The breach accelerated adoption of EMV chip technology across United States merchants and spurred investments in endpoint detection by vendors such as Symantec, McAfee, and Trend Micro. Retailers and financial institutions increased cooperation through information-sharing organizations like Information Sharing and Analysis Center and initiatives involving NIST Cybersecurity Framework adoption. The incident informed curricula at institutions including Harvard Business School and Stanford Graduate School of Business and prompted policy research from think tanks such as the Brookings Institution and RAND Corporation. Subsequent security incidents at companies like Home Depot and Sony Pictures Entertainment were analyzed in light of changes first highlighted during the Target incident, shaping standards at PCI SSC and prompting broader industry dialogues involving Amazon (company), Apple Inc., and Google LLC.

Category:Data breaches