Between November 27 and December 15, 2013, attackers installed malware on point-of-sale terminals across approximately 1,800 Target stores in the United States. The malware captured credit and debit card data - 40 million payment cards in total - from the terminals' memory as customers swiped or inserted their cards. An additional 70 million customers had name, address, phone number, and email address stolen from a separate Target database. The breach became public on December 18 when journalist Brian Krebs published it, sending a tsunami of media coverage into the holiday shopping season. It was the second-largest retail breach in US history at the time, behind TJX.
The Target breach is studied as a case in cascading security failures rather than sophisticated technical attack. The malware itself - BlackPOS - was commercially available and not particularly novel. The initial access vector was a compromised HVAC vendor. The network segmentation that should have prevented lateral movement from the vendor access into POS systems did not exist. Target's security team received alerts from their FireEye security tool when the malware was installed and did not act on them. The result was a loss that cost Target approximately $162 million in direct costs, the resignation of its CEO, and a lasting change to the PCI DSS requirements that the industry operated under.
BlackPOS: Memory Scraping Malware
Point-of-sale terminals briefly hold unencrypted card data in memory during transaction processing. The magnetic stripe contains a track 1 and track 2 data payload including the primary account number, expiration date, service code, and CVV. At the moment the terminal reads the card and before it encrypts the data for transmission to the payment processor, this data exists in plaintext in the terminal's RAM. Memory scraping malware scans running processes, finds the card data pattern (matching credit card number formats and associated data), and exfiltrates it.
BlackPOS (also known as Kaptoxa) was a toolkit sold in Russian criminal forums that automated this process. The version used in the Target attack was modified from a publicly available build, customized for Target's environment. The attacker installed BlackPOS on each POS terminal as a Windows service named POSWDS, which ran continuously, scraped memory at intervals, and staged the captured card data locally. A separate component moved the data to an internal staging server using NetBIOS file sharing, then a third component connected the staging server to attacker-controlled external servers via FTP.
The Fazio Mechanical Breach
Initial access to Target's network came through Fazio Mechanical Services, a Pennsylvania HVAC contractor that had a remote access connection to Target's systems for electronic billing and submitting support requests. Fazio's systems had been compromised with Citadel malware (a Zeus variant) through a phishing email, giving the attackers access to Fazio's credentials for Target's vendor portal.
The vendor portal was a legitimate business system. Contractors legitimately needed access to certain Target systems for billing and support purposes. The architectural problem was that this access - vendor billing and HVAC monitoring - was on the same network as Target's payment card processing systems, with insufficient segmentation between them. From the vendor portal entry point, attackers pivoted to reach POS systems in stores.
This lateral movement traversed several networks and systems before reaching POS terminals. Target's network infrastructure at the time used a relatively flat architecture for internal systems, and the credentials the attackers obtained or harvested during their reconnaissance were sufficient to reach the POS management system. Once they could deploy to the POS management system, installing malware on individual store terminals was straightforward.
The FireEye Alert That Was Ignored
Target had deployed FireEye, a leading security tool, across its network. The FireEye system detected BlackPOS when it was installed on the POS terminals in late November 2013 and generated alerts. A security operations center in Bangalore that monitored Target's alerts received these notifications and escalated them to Target's security team in Minneapolis. According to subsequent reporting by Bloomberg Businessweek, the Minneapolis team did not take action on the alerts.
The reasons for this inaction were not comprehensively documented, but the Bloomberg investigation described an environment where alert fatigue was a significant issue - a common problem in large enterprise security operations where security tools generate thousands of alerts daily, many false positives, and genuine detections can be buried in noise. The FireEye system had been configured with automatic quarantine options disabled, which was a deliberate choice (automatic quarantine in a retail environment carries risk of false-positive operational disruption) but which meant that human action was required.
The Target case became the canonical example of alert fatigue as a systemic security failure. Security teams in organizations of Target's scale receive enormous volumes of alerts; the ability to identify and prioritize genuine detections is a persistent challenge. The FireEye detection was real and would have terminated the breach within days of its start if acted upon. The 19-day duration of the breach - and the 40 million cards stolen - was a direct consequence of the failure to respond.
The PCI Response
The Target breach exposed fundamental weaknesses in the Payment Card Industry Data Security Standard (PCI DSS) compliance framework. Target was PCI compliant at the time of the breach. PCI compliance is point-in-time assessment against a checklist; it does not guarantee that a network is secure against all attacks, and it does not require the kind of network segmentation that would have prevented the vendor-portal-to-POS lateral movement.
The breach accelerated the US transition to EMV (chip and PIN / chip and signature) payment cards. EMV chip transactions generate a one-time transaction code that cannot be reused, making stolen card data less valuable for in-person fraud. The US had been the last major market still using magnetic stripe technology, partly due to the infrastructure investment required by retailers. Target's breach - and the TJX breach before it - provided the economic argument for EMV adoption that industry resistance had delayed. All major US banks had issued chip cards and most retailers had deployed chip readers by 2016.
EMV substantially reduced counterfeit card fraud at point of sale. Fraudsters responded by shifting to card-not-present fraud (online transactions, which do not use the chip), which increased significantly in the years following EMV adoption. The card data stolen from Target before EMV adoption was used primarily for counterfeit physical cards; post-EMV, POS malware attacks became less valuable for this purpose and declined.
The Attribution and Arrests
The Ukrainian teenager Rescator (identified by Brian Krebs as Andrey Hodirevski) was identified as the administrator of the card shop that sold the Target card data. The initial access through Fazio Mechanical was traced to a criminal group with ties to Eastern European cybercrime networks. A 2014 indictment charged Russian national Evgeniy Bogachev (operator of GameoverZeus, which delivered the Citadel variant that compromised Fazio) as a related actor, though the specific connection was indirect.
No arrests were ever made in connection with the Target breach specifically. The individuals responsible for developing BlackPOS, deploying it to Target's network, and operating the exfiltration infrastructure were not charged. This was a consistent pattern in retail POS malware cases of the era: the criminal infrastructure was identifiable through law enforcement investigation, but the operators were in Russia, Ukraine, or other jurisdictions with no extradition relationship with the United States.