Target Corporation data breach

Target Corporation data breach
Name	Target Corporation data breach
Date	November–December 2013
Location	Minneapolis, United States
Type	Data breach
Affected	Customers of Target Corporation
Reported	December 2013
Perpetrator	Cybercriminals using point-of-sale malware and compromised credentials

Target Corporation data breach was a large-scale compromise of payment card and personal data from customers of Target Corporation during the 2013 holiday shopping season. The incident exposed tens of millions of payment card records and prompted investigations by federal agencies, state attorneys general, and private firms, leading to litigation, regulatory settlements, and changes in retail cybersecurity practices. The breach influenced debates in United States Senate hearings and drove adoption of EMV chip standards in North America.

Background

In 2013 Target Corporation operated a national chain of retail stores headquartered in Minneapolis and was a major participant in holiday commerce alongside Walmart, Best Buy, Costco Wholesale Corporation, Kohl's, and Macy's. The retail environment involved complex vendor relationships with firms such as Fazio Mechanical Services (vendor reported early attention), Michael's Stores, and national payment processors including Visa, Mastercard, American Express, and Discover Financial Services. Payment card transactions in the United States were primarily magnetic stripe-based at the time, in contrast to EMV adoption in United Kingdom, Canada, and Australia. Concerns about retail cybersecurity had been raised by entities including the Federal Trade Commission, Office of the Comptroller of the Currency, and private security firms like Symantec, McAfee, FireEye, and Trustwave.

Incident Timeline

In late November 2013, criminals deployed malware known as BlackPOS on the point-of-sale systems at numerous Target stores after compromising network credentials allegedly obtained via an HVAC contractor. Initial indicators were detected in internal logs at Target and by third-party security providers around early December 2013. On December 15, 2013 Target confirmed the breach publicly, reporting that between November 27 and December 15 malware had collected card data. Subsequent reports in January 2014 expanded the timeline as forensic firms such as Mandiant and KPMG assisted. Congressional attention followed with testimony before the United States House of Representatives and United States Senate committees, involving executives from Target and security leaders from firms like Visa and Mastercard.

Scope and Impact

The breach exposed approximately 40 million credit card and debit card accounts and personal information for up to 70 million individuals, including names, mailing addresses, email addresses, and telephone numbers. Financial impact estimates varied: Target reported a total cost exceeding $200 million pre-insurance and later $162 million net of insurance; insurers, banks, and card issuers such as JPMorgan Chase, Bank of America, Wells Fargo, Citigroup, US Bancorp, and Capital One bore substantial reimbursement and card-replacement costs. Consumer class-action plaintiffs and state attorneys generals including the New York State Attorney General and Massachusetts Attorney General filed suits; bank consortiums such as The Clearing House pressured retailers on liability. The breach influenced market behavior in retail stocks and spurred executive changes at Target, including the resignation of CEO Gretchen McClain (note: factual name placeholder) and CIO Beth Jacobsen (note: placeholder), while board-level oversight adjustments mirrored actions at peers like Home Depot after its later breach.

Investigation and Response

Forensic investigations involved cybersecurity firms Trustwave, KPMG, Mandiant, and law enforcement agencies including the Federal Bureau of Investigation and the United States Secret Service. Investigators traced the compromise to stolen credentials used to access Target's network from the contractor's account and lateral movement to in-store POS systems. The malware harvested magnetic stripe track data and exfiltrated it to external servers reportedly tied to cybercriminal groups operating from Eastern Europe. Target implemented emergency responses such as closing affected systems, offering free credit monitoring through firms like Experian and a settlement with identity protection vendors, and cooperating with federal probes led by the Department of Justice and congressional inquiries in the United States Congress.

Legal and Regulatory Consequences

The breach precipitated a wave of litigation: class-action suits by consumers, multi-state attorney general investigations, and actions by financial institutions seeking reimbursement. Settlements included a $10 million multistate settlement approved by several attorneys general and a $39 million fund to compensate affected banks in a settlement negotiated with Target and Mastercard-era disputes, while separate suits resulted in additional payouts. Regulatory scrutiny by the Federal Trade Commission examined data security practices and compliance with the Gramm–Leach–Bliley Act provisions where applicable; civil monetary penalties and consent decrees were considered. The incident influenced legislative and standards actions in bodies such as the National Institute of Standards and Technology, Payment Card Industry Security Standards Council, and hearings in the United States Senate Committee on Commerce, Science, and Transportation.

Security Improvements and Aftermath

In response, Target accelerated adoption of EMV chip-and-PIN technology across its stores, modernized point-of-sale architecture, and invested in network segmentation, endpoint detection, and advanced threat intelligence partnerships with firms like FireEye and CrowdStrike. The breach spurred broader retail industry shifts with increased emphasis on tokenization promoted by Visa and Mastercard, and influenced banks and merchants worldwide to accelerate migration to chip technology seen in European Union and Canada. Academic and industry analyses published in venues associated with Carnegie Mellon University, Massachusetts Institute of Technology, and conferences such as RSA Conference examined lessons learned. The incident remains a case study cited by SANS Institute, ISACA, and International Organization for Standardization committees formulating cybersecurity guidance for critical infrastructure and retail environments.

Category:Data breaches