In November 2013, attackers accessed Target Corporation's internal network through credentials stolen from a third-party HVAC vendor. Over the following weeks, they installed malware on point-of-sale systems in nearly every Target store in the United States. When the breach was finally identified by the US Department of Justice in December 2013, 40 million payment card records had been stolen. The breach cost Target an estimated $300 million in settlements and remediation costs, triggered a wave of retail POS breaches, and changed how the payments industry thought about network segmentation.
The Entry Point: A Third-Party HVAC Contractor
The initial access vector was not a sophisticated zero-day or nation-state capability. It was phishing. Fazio Mechanical Services, a small refrigeration and HVAC contractor that serviced Target stores, was compromised through a phishing email that installed the Citadel trojan on their systems. Fazio had network access to Target's vendor portal for electronic billing and project management purposes.
Target's vendor portal was connected to the same network as its point-of-sale infrastructure. From the vendor credentials, attackers pivoted to Target's internal network. The specific path from the vendor portal to the POS network depended on insufficient network segmentation - the contractor's access was not appropriately isolated from systems that processed payment card data.
The POS Malware: BlackPOS (Kaptoxa)
The malware deployed on Target's POS systems was a RAM scraper known as BlackPOS, also called Kaptoxa. POS RAM scrapers work by targeting the brief window in which payment card data exists in cleartext in memory during transaction processing. When a customer swipes a card, the POS terminal reads the Track 1 and Track 2 data from the magnetic stripe. This data - cardholder name, account number, expiration date, service code - exists in the payment application's memory for milliseconds before being encrypted and transmitted. BlackPOS monitored running processes for card data patterns and captured it from memory before encryption.
BlackPOS was first identified in 2012 and was commercially available on Russian cybercrime forums for approximately $2,000. It was not a sophisticated custom tool - it was commodity malware. The sophistication in the Target attack was the operational planning: identifying the entry point, pivoting from the vendor portal to POS systems, deploying the malware across ~1,800 stores, and establishing an exfiltration channel within Target's network (a server on Target's internal network received scraped card data, which was then exfiltrated externally).
Detection and Response
Target had purchased FireEye's enterprise security software and deployed it before the breach. FireEye's system detected the malware during installation in November 2013 and generated alerts. Target's security operations team in Bangalore received those alerts and escalated them - the escalations were not acted upon by Target's security team in Minneapolis. Target's breach was ultimately disclosed not by their own detection but by a notification from the US Department of Justice in mid-December 2013.
This aspect of the breach - that functional detection tools identified the attack and the alert was ignored - became a recurring theme in subsequent breach investigations. The failure was organizational, not technical. The tools worked; the processes for responding to alerts did not.
Brian Krebs, the security journalist who broke the public story of the Target breach in December 2013, received a tip from card fraud investigators at several banks who had noticed elevated rates of fraudulent transactions on cards that had recently been used at Target. The financial industry's fraud detection systems identified the breach pattern before Target's internal systems or the retail sector's own monitoring did.
Attribution and Arrests
The malware was attributed to a group operating primarily out of Eastern Europe, specifically Ukraine and Russia. In February 2014, a Ukrainian 22-year-old named Sergei Taraspov (known as "ree4") was identified as having initially deployed the malware on Target's systems. The operational infrastructure was attributed to a more established criminal network.
The Russian national identified as the primary operator behind the Target breach and related campaigns was Andrei Khiluta. He operated under multiple handles on carding forums and had been selling BlackPOS to other criminal groups. Several co-conspirators in Ukraine, Romania, and the United States were subsequently indicted. The operations involved in distributing the stolen card data - the carding forums, money mule networks, and fraudulent transaction processing - were substantially more distributed than the initial breach team.
The Retail Breach Wave
The Target breach was followed by a wave of retail POS compromises using similar techniques: Home Depot (56 million cards, 2014), Neiman Marcus (1.1 million cards, 2013-2014), Michaels Stores (3 million cards, 2014), Sally Beauty, Kmart, Staples, and dozens of smaller retailers. The tools and techniques varied but the entry pattern was consistent: third-party contractor credentials, insufficient network segmentation, RAM scraping malware on POS terminals.
The scale of the retail breach wave accelerated the US transition to EMV chip payment cards. The payment industry had been working toward EMV adoption for years; the Target breach provided the political and business pressure to accelerate the timeline. The major card networks set October 2015 as the liability shift date for US merchants - after that date, merchants who had not deployed EMV-capable terminals would be liable for counterfeit card fraud that EMV would have prevented. The magnetic stripe provides trivially cloneable data; EMV chip cards generate a unique cryptogram per transaction that cannot be replayed.
Legacy: Network Segmentation and Vendor Risk
Target's CIO resigned in March 2014. The CEO resigned in May 2014. The company reached a $10 million class action settlement with affected consumers, a $39 million settlement with banks, an $18.5 million multistate settlement, and numerous other legal resolutions. The total financial cost was approximately $292 million against $90 million in insurance reimbursement, leaving Target with a net cost of around $202 million.
PCI DSS v3.0, released in 2013, included more specific requirements around third-party vendor security and network segmentation. The 2014 supplements to PCI DSS specifically addressed the Target-style attack pattern. Network segmentation between cardholder data environments and other systems became a more clearly defined requirement.
The Target breach is significant not because of its technical sophistication - it used commodity malware and a basic social engineering vector - but because of how clearly it demonstrated the structural weaknesses in large enterprise security: third-party access insufficiently isolated from sensitive systems, detection alerts that went unacted upon, and a network architecture that allowed a contractor's credentials to reach POS systems across 1,800 stores. The same weaknesses existed throughout the retail sector, and they were exploited throughout the two years that followed.