How a heating contractor's login led to a retail breach

The story

During the 2013 holiday shopping season, attackers stole payment card details from tens of millions of shoppers at Target stores in the United States.

The investigation found that they did not break in through Target’s own staff. They first stole login details from a small heating, ventilation and air conditioning contractor that had access to Target’s network for billing and contract paperwork. From that foothold, the attackers worked their way to the checkout systems in stores and installed software that captured card details as they were swiped.

What went wrong

• Vendor access reached too far. A contractor’s login for invoices was a path to the systems that took payments.
• Systems were not separated. Once inside, the attackers could move from one part of the network to another.
• Warnings were missed. Reports later said security tools had raised alerts that were not acted on in time.

The lesson today

Every business relies on vendors who need some access: software support, building systems, payroll, equipment makers. Each of those connections is a way in. Giving each vendor only what it needs, keeping its access separate, and turning access off when it is no longer needed are some of the most effective protections a business can have, and they cost very little.