Target 2013: how a supplier's login led to 41 million payment cards

Nabayn did not work on this incident. This is our analysis of what is on the public record, written so other organisations can learn from it.

Big retailers spend a great deal on security, yet one of the most famous retail breaches began with a login belonging to one of Target’s suppliers. For a small business, it is a useful reminder that your security also depends on who else you have let in.

What happened

In November 2013, hackers accessed Target’s systems using legitimate credentials stolen from a third-party vendor. The breach affected the personal information of over 60 million customers and the payment card accounts of over 41 million customers. The data included names, phone numbers, email and postal addresses, payment card numbers, expiry dates, card verification codes and encrypted debit PINs.¹

A multi-state investigation, led by the Attorneys General of Connecticut and Illinois, found that the attackers had accessed Target’s gateway server through credentials stolen from a third-party vendor.² Reports describe that entry point as a heating, ventilation and air conditioning contractor.³

The important point is that the supplier had nothing to do with payment cards. Its login was simply a way in to the wider network.

What followed

In 2017, Target agreed to pay $18.5 million to settle claims by 47 states and the District of Columbia.² At the time, it was described as the largest multi-state data breach settlement to date.¹

The settlement also required changes. Target had to develop and maintain a comprehensive information security programme with an executive responsible for it, reporting to the chief executive and the board. It also had to implement access restrictions, collect logs and monitor network activity, manage and document changes to network systems, and use encryption to protect card data.¹ Reports also say that its security had to be assessed by a third party, and that it had to audit its vendors and subcontractors.³

What a small business can learn

You probably have suppliers with some access to your systems: a web developer, an IT provider, an accountant or a booking system. The risk works the same way at a smaller scale. These suggestions are ours.

List who can get in. Write down every person and company with access to your website, email, accounts or systems. Include former staff and old contractors. Many business owners are surprised by how long this list gets.

Give the minimum access. A company that services your air conditioning should not be able to reach your customer records. A web designer may need access to your website, but not your bank or email.

Use separate logins, not shared ones. If everyone uses the same password, you cannot remove one person, and cannot see who did what. Give each supplier their own account, so you can close it on the day the work ends.

Require two-step sign-in. A stolen password alone should not be enough.

Keep your systems apart. Your till or card machine should not be on the same open network as your guest wifi or office computers. If you are not sure, ask your IT provider or card provider.

Do not store card data. Use a payment provider that handles it, so that you do not hold what attackers want. Never write card numbers in a spreadsheet or an email.

Check your suppliers’ basics. You can reasonably ask if they use two-step sign-in, and whether they hold a certificate such as Cyber Essentials.

Review it twice a year. Put it in your diary, and remove anything you no longer need.

If personal data is involved, you may have to report a breach quickly. See UK GDPR basics. For another view of supplier risk, read about SolarWinds.