The contractor
Fazio Mechanical Services is a heating, ventilation and refrigeration contractor in Sharpsburg, Pennsylvania. Like thousands of suppliers to large retailers it had remote access to its customer's systems - not to anything sensitive, but to the ordinary business plumbing: billing, project management, contract documents, through a supplier portal.
About two months before the breach, someone at Fazio opened a phishing email. It installed Citadel, a well-known credential-stealing program, and took the company's portal login. One detail from the reporting deserves to be read slowly by anyone who manages a small business or advises one: the machine was running the free version of a reputable anti-malware product. The free version scans when a user asks it to. The paid version scans in real time and would very likely have caught a program as well known as Citadel. The difference between the two, in this instance, was a hundred million records.
From the billing portal to the tills
With the 's credentials the attackers were inside Target's network. What should have stopped them there is segmentation - the principle that a supplier's billing portal has no path to the systems that process payments. There was no such separation, and they moved from one to the other.
Then they deployed a tailored version of BlackPOS, sometimes called Kaptoxa: memory-scraping malware for point-of-sale terminals. This is the technically instructive part, and it explains why the encryption everyone assumes was in place did not help. A card's magnetic-stripe data is encrypted when stored and encrypted when transmitted, but at the instant the terminal authorises the transaction it must hold the data in a form it can use - plaintext, in memory, for a fraction of a second. RAM scraping waits there. Encryption at rest and in transit protects everything except the moment of use, and the moment of use is where the money is.
Collection began on 27 November 2013 - the start of the American holiday shopping weekend, the highest-volume period of the retail year - and ran until 15 December, across 1,797 stores. About forty million payment cards were taken, along with the personal details of seventy million customers. The data left the network by file transfer to staging servers.
The alerts
Target had deployed a well-regarded malware detection product. It worked. During the malware's installation the system generated alerts, and the United States Senate Commerce Committee's staff report on the breach records that those warnings did not prevent it. Reporting indicates the alerts were seen and not escalated to anyone who acted on them.
Nor did Target find the breach itself. It learned about it from outside - through the payment industry noticing suspicious transactions, and then publicly when Brian Krebs published on 18 December that Target was investigating a breach, with the company confirming the following day. By then the attackers had been collecting card data for almost three weeks.
The consequences were institutional. The total cost has been put above two hundred million dollars in settlements, direct expenses and lost sales; the chief executive and the chief information officer both left.
Why this article exists
Every other incident in this catalogue involves something broken. EternalBlue was a flaw in a protocol. Mirai was a factory default. DigiNotar was a network with one password. Target is the case where the technology did its job and the organisation did not.
That makes it the cleanest evidence for the argument that security is a clock rather than a codebase. Detection happened. Every stage after it failed:
- Triage - somebody had to decide the alert mattered, and the decision went the wrong way.
- Escalation - the finding had to reach a person with authority to stop a payment system during the busiest fortnight of the year, and it did not.
- Containment - there was no rehearsed action to take, so there was nothing to trigger.
- The gap between detecting and knowing - three weeks, during which the mechanism was working and the response was not.
A detection tool with no answer to "and then what happens" is a logging system with a marketing budget. This is exactly why the playbook argument is about decisions made in advance: who may disconnect a segment without waiting for approval, and who they call at two in the morning on the Saturday after Thanksgiving.
The supply chain route this represents
The supply chain taxonomy sorts these by route, and Target is a distinct one worth naming precisely. In the 3CX and MOVEit cases, the attacker compromised a supplier's product and it carried them to the customers. Here they compromised a supplier's access - no product, no update channel, no code. A contractor with a login, and a network that treated that login as if it belonged inside.
The practical question that follows is not "do we trust this vendor" but a narrower and answerable one: what can this vendor's credentials reach, and who checked? Most organisations can list their suppliers. Far fewer can produce, for each one, the set of systems its access actually touches - which is the audit worth running after reading this.
What a practitioner should take from it
Third-party access is a network design problem, not a procurement one. A vendor questionnaire does not create a boundary. A separate segment, a jump host, credentials scoped to one application and a time limit on the access do.
Encryption does not cover the moment of use. Anything that must process data holds it in the clear, briefly, and that is where memory-scraping malware lives. Point-to-point encryption and tokenisation, which move the plaintext out of the merchant's terminal entirely, exist because of breaches shaped like this one.
An unactioned alert is worse than no alert, because it creates a record that the organisation knew. That is a legal and a reputational fact as much as a technical one, and it is the reason alert volume needs to be managed as carefully as coverage.
And passing an audit is not the same as being defensible. The 2011 pair makes the same point about a certificate authority audited annually while its servers shared a password. Compliance measures what can be documented. Whether an alert would reach someone who acts on it, at three in the morning in December, is not on any checklist - and it is the thing that decided this case.
Sources
- Red River, summarising the United States Senate Commerce Committee staff report: attackers gained access through credentials belonging to Fazio Mechanical Services, a Pennsylvania HVAC and refrigeration contractor with remote access for billing, project management and contract work, then moved through multiple internal systems; they installed RAM-scraping malware on point-of-sale terminals, capturing payment data while temporarily in plaintext in memory; a tailored version of BlackPOS was identified; Target's FireEye system generated alerts during malware installation but those warnings did not prevent the breach
- Dark Reading, February 2014, on Brian Krebs' reporting: investigators suspect attackers gained access using credentials obtained from Fazio Mechanical Services via a phishing attack at least two months before the card theft; the theft began on 27 November, Target confirmed the breach on 15 December, and it took until 18 December to fully remove the malware and stop the exfiltration
- Portnox: attackers sent a phishing email to Fazio employees and one person fell for it; the laptop was protected with the free version of Malwarebytes, which scans when initiated by the user, whereas the paid version has a real-time scanner that probably would have caught Citadel, which was well known
- Medium case study: the phishing email was sent to Fazio about two months before the breach and delivered Citadel, a password-stealing bot probably embedded in a document; it obtained the login credentials for the online vendor portal, indicated to be Target's Ariba external billing system; the Senate Committee on Commerce concluded in March 2014 that Target had missed opportunities to prevent the breach
- Akimbo Core: the story was broken by Brian Krebs on 18 December 2013 in a post titled "Sources: Target investigating Data Breach", followed by Target's own statement on 19 December; the confirmation stated the breach lasted from 27 November to 15 December and that approximately 40 million payment cards had been stolen
- Cloudskope timeline: Citadel delivered by phishing to the HVAC contractor; Fazio's vendor portal credentials stolen for the Ariba supplier system; attackers pivoted from the vendor portal to internal systems exploiting inadequate network segmentation between vendor and point-of-sale systems; BlackPOS deployed to scrape Track 1 and Track 2 data during card authorisation; alerts reportedly investigated but not escalated to remediation; 40 million payment card records and 70 million customer records exfiltrated
- Breachsense: attackers moved laterally until they reached point-of-sale systems across 1,797 stores and captured card data for nearly three weeks; the breach was not discovered by Target's own team - an external payment processor identified suspicious transactions in mid-December; the FireEye system flagged the malware and nobody investigated; total cost exceeded 200 million dollars in settlements, direct expenses and lost sales, and both the chief executive and the chief information officer resigned