On November 15, 2013, somebody walked into Target's network carrying a refrigeration contractor's login. Sources close to the investigation told Brian Krebs that was the first entry, and the credentials belonged to Fazio Mechanical Services, a refrigeration contractor for supermarkets based in Sharpsburg, Pennsylvania. The account existed for paperwork. Fazio's own statement, issued through a PR firm in February 2014, said its data connection to Target was "exclusively for electronic billing, contract submission and project management." From that foothold the intruders eventually reached the cash registers, and between November 27 and December 15, 2013, malware scraped 40 million card numbers out of the memory of payment machines while customers shopped for the holidays. A January follow-up by Target put the personal details of up to 70 million customers in the same haul.
The credentials were not stolen that week. Krebs's sources put the theft at least two months before the card data started flowing, which lands it no later than September 2013. Hold that date. Target's chief financial officer, John Mulligan, told Congress in February that his company had been certified compliant with the Payment Card Industry Data Security Standards in September 2013. The Senate Commerce Committee's review of the breach, published in March, records the certification and then adds a flat sentence: "These steps were obviously not sufficient to prevent the breach."
Certified is a photograph
A compliance audit certifies a snapshot of one company. The Target file usually gets read as a vendor-negligence story, and I think that is the wrong cut. It is a reach story. Attackers do not shop for snapshots. They shop for reach, and every credential you issue outward is only as safe as the least-defended machine its holder types it on. PCI-DSS had plenty to say about Target's own walls. It had nothing to say about the free antivirus on a subcontractor's office PC. Investigators told Krebs the company's primary method for detecting malicious software was the free version of Malwarebytes Anti-Malware, an on-demand scanner with no real-time protection, built and licensed for individual users. Fazio's statement, for its part, insisted its "IT system and security measures are in full compliance with industry practices." One company's compliance was certified; the other's was asserted. Forty million cards left the building anyway.
There is decent reason to believe the intruders never chose Target directly. Krebs's read of the campaign was a shotgun email blast, followed by weeks of combing the victim list for anyone interesting. Target had made the combing easy: its public supplier portal carried facilities-management pages and downloadable spreadsheets for HVAC vendors, and the metadata inside those files sketched internal Windows domains. The Senate report draws the same map in its recon section. Publish the wiring of your vendor world to the open web and you are doing the attacker's research for free.
Reach, not theft
What turned a stolen password into one of the biggest card heists in retail history was not the theft. It was what the stolen account could touch. From a foothold in an external billing system, the intruders worked inward and uploaded RAM-scraping malware to point-of-sale machines, a tailored build of a kit called BlackPOS that was then selling on crime forums for between $1,800 and $2,300, according to the Senate report. Target's own intrusion gear noticed. The report says the FireEye software sent an alert under the generic name "malware.binary" as the malware landed, and that the software even decoded the destination servers where the stolen card data was stored. Acting on the several alerts triggered at the time of delivery, the committee found, could have stopped the exfiltration.
The lock in this story is the part nobody at Target owned. Fazio held the key, and Fazio's defenses were the free tier of a consumer product.
The most clarifying number in the whole file arrived three and a half years later: $18.5 million. That is what 47 states and the District of Columbia took from Target in May 2017 to close their investigation into the breach, and the interesting part of the settlement is not the money. It is what the states ordered the company to build: segment cardholder data away from the rest of the computer network, rotate passwords, and put two-factor authentication on certain accounts. Not "audit your vendors harder." Not "buy better antivirus." The regulators who read the whole case concluded the fix was architectural. A billing login must never be able to matter to a cash register, whatever the vendor's worst day looks like.
The keys I count
The credentials our systems hold toward the outside world make a short list, and I keep it short on purpose: the payment processor, object storage, and one review hop bound to a private bridge address the public internet cannot route to. Each key opens exactly one room. The processor can tell us a payment settled, and that verdict arrives as a signature-verified webhook server-side, the only event that moves a rank. Storage holds the rendered promo videos. The review hop receives sanitized metadata, a URL, a contact email and the buyer's own ad copy, and the page text our fetcher reads never travels to the reviewer at all. If one of those keys were phished tomorrow, the reach is one room, not the house.
The discipline the Target story forces on a small operator is a written list. Every login your systems accept, every credential you have issued outward, one line each, and beside each line the honest answer to what its worst day could reach. That list is boring until the day it is the only thing standing between a contractor's office PC and your cash registers. Count your keys before somebody else does, and when your site is ready for more daylight, the board is at bidspotlight.com/submit.