Target data breach

Target data breach
The original uploader was Hayfordoleary at English Wikipedia. · Public domain · source
Name	Target data breach
Date	December 2013
Location	United States
Type	Data breach
Cause	Malware on point-of-sale systems
Disclosed	December 2013
Reported by	Target Corporation

Target data breach was a major cybersecurity incident disclosed in December 2013 that affected millions of consumers and had wide-reaching effects across retail banking, retail operations, cybersecurity policy, and legal frameworks. The compromise occurred during the 2013 holiday shopping season and precipitated responses from corporations, financial institutions, regulators, and legislators, reshaping practices at companies including Target Corporation, Home Depot, Neiman Marcus, and influencing standards maintained by organizations such as the Payment Card Industry Security Standards Council and National Institute of Standards and Technology.

Background

The breach unfolded against a backdrop of prior incidents involving entities like TJX Companies, Sony Pictures Entertainment, RSA Security, Equifax, and Heartland Payment Systems. Major financial firms including JPMorgan Chase, Bank of America, Wells Fargo, Citigroup, and Capital One had been contending with card fraud and data theft. Retailers such as Walmart, Best Buy, Kmart, Sears, and Costco Wholesale monitored developments in point-of-sale security following earlier compromises linked to malware strains like BlackPOS and attacks attributed to groups resembling threats observed in breaches of Adobe Systems and eBay. The Payment Card Industry Data Security Standard (PCI DSS), overseen by the Payment Card Industry Security Standards Council, and guidance from agencies like Federal Bureau of Investigation and Department of Homeland Security informed industry expectations prior to December 2013.

Breach details

Malware was installed on point-of-sale terminals at numerous Target stores nationwide. Attack techniques resembled those used against Home Depot and Neiman Marcus, involving network intrusion vectors linked to third-party vendors such as Fazio Mechanical Services and software tools analogous to remote access utilities used by contractors and suppliers. The intrusion exploited credentials and moved laterally through networks, exfiltrating track data from magnetic-stripe cards used in transactions processed by card issuers including Visa, Mastercard, American Express, and Discover Financial Services. Reports noted that approximately 40 million card numbers and personal information for roughly 70 million individuals, names and email addresses among them, were exposed; entities involved in fraud investigation included U.S. Secret Service, United States Attorney General, Federal Trade Commission, and state attorneys general such as those from Minnesota and California.

Investigation and response

Target engaged external cybersecurity firms and law enforcement partners, coordinating with agencies including the Department of Justice, FBI, and Secret Service. Investigations drew on forensic analyses by firms like Mandiant and FireEye and reporting from media outlets including The New York Times, The Washington Post, Wall Street Journal, Bloomberg, and Wired. Target's executive leadership, including then-CEO Gregory Steinhafel, testified before congressional committees such as the United States House Committee on Energy and Commerce and United States Senate Committee on Commerce, Science, and Transportation. Financial sector responses involved card reissuance programs and collaboration with networks like Visa Europe and organizations like the Internal Revenue Service for potential tax-fraud monitoring. Retail and cybersecurity vendors including Symantec, McAfee, Trend Micro, Kaspersky Lab, Palo Alto Networks, and Cisco Systems participated in analysis and mitigation.

Impact and consequences

The breach affected stakeholders spanning consumers, merchants, and financial institutions such as SunTrust, U.S. Bank, and PNC Financial Services. Target reported significant financial impacts, leading to leadership changes and strategic shifts similar to those seen after breaches at Sony Pictures Entertainment and Equifax. Stock markets and investors including BlackRock, Vanguard Group, and State Street Corporation monitored Target's performance. The incident spurred increased adoption of chip-and-PIN and EMV standards championed by Europay, MasterCard, and Visa Inc. and accelerated investment in tokenization initiatives supported by Apple Pay and Google Wallet partners. Retail analytics firms like Nielsen and Forrester Research tracked consumer confidence effects, while academic research at institutions such as Massachusetts Institute of Technology, Stanford University, Carnegie Mellon University, and University of California, Berkeley examined systemic vulnerabilities.

Legal actions and settlements

Target faced numerous lawsuits and regulatory actions brought by consumers, banks, and state governments including cases initiated by plaintiffs represented by law firms such as Quinn Emanuel and Covington & Burling. Settlements included multi-party agreements with financial institutions and class-action settlements overseen in federal courts such as the United States District Court for the District of Minnesota. The litigation landscape involved statutes and enforcement by bodies like the Federal Trade Commission and state attorneys general from jurisdictions including New York and Illinois. Target ultimately agreed to pay sums for card replacement, monitoring services, and civil penalties, and negotiated settlements with banking consortia and plaintiffs that resolved claims related to negligence and data security failures.

Security reforms and lessons learned

The breach catalyzed reforms in retail and payment security policies, accelerating EMV migration overseen by EMVCo and prompting revisions to PCI DSS practices enforced by the Payment Card Industry Security Standards Council. Corporations invested in endpoint protection by vendors such as CrowdStrike, Carbon Black, and SentinelOne, and increased use of network segmentation, intrusion detection systems from Splunk and IBM Security QRadar, and managed security services from firms like AT&T Cybersecurity and SecureWorks. Legislative and regulatory attention from bodies including the United States Congress, Federal Communications Commission, and state legislatures led to new disclosure norms and discussions on liability frameworks referencing precedents set by cases involving Sony Corporation and Equifax Inc.. The incident reinforced best practices promoted by National Institute of Standards and Technology publications and influenced corporate governance at public companies monitored by exchanges like New York Stock Exchange and NASDAQ.

Category:2013 crimes in the United States Category:Data breaches