How did the Target data breach happen?

In late 2013, attackers gained access to Target’s network using stolen credentials belonging to a third-party HVAC contractor. They later moved to the retailer’s point-of-sale systems, deployed malware and stole payment card data from around 40 million customers. More than a decade later, the incident remains one of the clearest examples of how trusted third-party access can become an organisation’s greatest cyber security risk.

The 2013 Target data breach is widely regarded as one of the most significant retail cyber attacks in history. It did not begin with an advanced exploit against Target’s own systems or a sophisticated zero-day vulnerability. Instead, attackers compromised a trusted supplier before using legitimate credentials to gain access to the retailer’s internal network.

Once inside, they quietly moved between systems, reached payment processing devices and installed malware that harvested customer payment card data during one of the busiest shopping periods of the year. By the time the breach became public, millions of payment cards had already been stolen and sold through criminal marketplaces.

The incident fundamentally changed how organisations think about third-party cyber risk. It highlighted that an organisation’s security is only as strong as the partners, contractors and suppliers with access to its environment.

What Happened During the 2013 Target Data Breach?

The attack occurred during the 2013 holiday shopping season, one of the busiest periods for retailers across the United States.

Target later confirmed that attackers had compromised approximately 40 million payment card accounts between 27 November and 15 December 2013. The company also disclosed that personal information belonging to around 70 million customers, including names, addresses, telephone numbers and email addresses, had been exposed during the wider incident. These findings were confirmed through Target’s public statements and subsequent investigations by security researchers and government agencies.

The timing was not accidental.

High transaction volumes during Black Friday and the lead-up to Christmas created an ideal environment for attackers. Millions of legitimate purchases made it more difficult to identify fraudulent activity while allowing attackers to collect large amounts of payment card data before detection.

The stolen card data quickly appeared on underground marketplaces, where cyber criminals sold it for fraudulent purchases and financial crime.

How Attackers Used a Third-Party HVAC Vendor to Gain Access

One of the defining characteristics of the Target breach was its entry point.

Rather than attacking Target directly, investigators determined that the attackers first compromised Fazio Mechanical Services, a heating, ventilation and air conditioning contractor that provided services to Target stores. The contractor maintained legitimate remote access for business operations such as billing and project management.

After obtaining the contractor’s credentials, attackers used those legitimate accounts to enter Target’s network.

This demonstrated an important lesson that remains relevant today. Attackers do not always need to break through an organisation’s security controls if they can instead compromise a trusted supplier with existing access.

Modern organisations rely on hundreds or even thousands of external partners, including managed service providers, cloud vendors, software suppliers and contractors. Every relationship introduces another potential pathway into the business if identities and permissions are not properly managed.

From Vendor Credentials to Point-of-Sale Malware

Initial access was only the beginning.

After entering Target’s network, the attackers moved laterally through the environment until they reached systems responsible for processing payment card transactions. Once there, they deployed BlackPOS, a type of memory-scraping malware designed to capture payment card information while it was temporarily stored in the memory of point-of-sale terminals.

Unlike attacks that target databases directly, memory-scraping malware collects payment card data before it is encrypted or securely transmitted. This allowed attackers to harvest card information without disrupting normal retail operations or immediately alerting customers.

The attack followed techniques that continue to appear in cyber intrusions today.

Attackers used legitimate credentials instead of exploiting software vulnerabilities, moved laterally between systems, escalated privileges where possible and targeted high-value assets before quietly exfiltrating stolen data.

Although the technology used in modern attacks has evolved, these underlying tactics remain common across financially motivated cyber crime groups.

The Impact on Target and Its Customers

The consequences extended far beyond the theft of payment card information.

Target faced significant financial losses, regulatory investigations, legal action and multiple settlements. Banks and financial institutions were forced to replace millions of compromised payment cards while customers dealt with fraudulent transactions and concerns about identity theft.

The breach also damaged Target’s reputation and prompted major investment in cyber security improvements across the retail sector.

More broadly, the incident accelerated the adoption of EMV chip-enabled payment cards in the United States and encouraged organisations to strengthen network segmentation, vendor management and payment security controls.

For many security professionals, the Target breach marked a turning point in how third-party cyber risk was understood.

Why the Target Breach Changed Supply Chain Security

The Target breach is often remembered as a payment card incident, but its real legacy is the lesson it taught about supply chain security.

Organisations increasingly depend on trusted external parties to deliver services, maintain infrastructure and manage business operations. Those organisations often require remote access to applications, cloud platforms and corporate networks.

If attackers compromise one of those trusted identities, they may inherit legitimate access into the primary target.

Reducing this risk requires more than technical controls alone.

Businesses should regularly review vendor access, apply least privilege, segment critical systems, enforce multi-factor authentication where appropriate and continuously monitor third-party accounts for unusual activity.

Every supplier relationship should be treated as part of the organisation’s wider attack surface.

How Monitoring Vendor and Workforce Credentials Helps Reduce Risk

Credential theft remains one of the most common ways attackers gain initial access.

Stolen usernames, passwords and authentication tokens continue to circulate within criminal ecosystems operating across Tor, Telegram and I2P, among other monitored sources. Once exposed, those credentials may be used weeks or even months later to compromise organisations that have not detected the leak.

Monitoring for exposed credentials provides organisations with an opportunity to respond before attackers do.

By identifying compromised accounts early, security teams can reset passwords, review privileged access, investigate suspicious activity and reduce the likelihood that exposed credentials become the first stage of a larger attack.

DarkThreatX helps organisations achieve this through dark web monitoring for business, continuously monitoring more than 100 billion records, ingesting over one million new stealer logs every week, operating 24/7, delivering validated alerts in under five minutes, and maintaining zero false positives through automated validation.

Combined with employee credential monitoring, organisations gain greater visibility into one of the most common attack paths used by cyber criminals today.

Conclusion

More than a decade after it occurred, the Target data breach continues to influence how organisations approach cyber security.

The attackers did not exploit an unknown vulnerability or develop an advanced new attack technique. They simply compromised a trusted third party, used legitimate credentials and moved through the environment until they reached valuable systems.

That lesson remains just as relevant today.

As organisations continue expanding their supplier ecosystems and digital operations, protecting third-party identities has become just as important as protecting internal users. Continuous monitoring, stronger access controls and rapid detection of exposed credentials can help reduce the likelihood that a trusted relationship becomes the next pathway for a major breach.