The 2013 Target breach: timeline and what defenders should learn

Attackers entered Target's network on 15 November 2013, according to reporting, using credentials stolen from a refrigeration and HVAC contractor, then spread card-stealing malware to point-of-sale registers. Target said about 40 million card accounts were exposed between 27 November and 15 December. A Senate staff report later said Target missed several chances to stop it.

This is a retrospective, built only from the sources linked below. Several details came from unnamed sources close to the investigation and were disputed or unconfirmed at the time, and we say so where it matters. We are not predicting anything. The lessons are about controls that remain ordinary good practice.

What happened, and when?

• 15 November 2013. Per KrebsOnSecurity, sources said the attackers first got in with network credentials stolen from Fazio Mechanical Services, a Pennsylvania refrigeration and HVAC provider.
• 15 to 28 November. Sources told Krebs the attackers uploaded card-stealing malware to a small number of registers and used the time to check it worked.
• By the end of November. Per the same reporting, the malware had reached a majority of point-of-sale devices and was collecting card records from live transactions. Target has said card data was exposed between 27 November and 15 December 2013.
• 19 December 2013. Target publicly acknowledged the breach, per BankInfoSecurity.
• 25 to 26 March 2014. The Senate Commerce Committee majority staff released "A Kill Chain Analysis of the 2013 Target Data Breach" ahead of a hearing.

The data was moved to staging servers the attackers had compromised, including machines in the United States and Brazil, according to Krebs's sources, before reaching the suspected perpetrators.

What did the Senate staff report conclude?

The report says it was based on media reports and expert analyses, not Target's own forensic findings. Within that limit, it listed four apparent failures, as summarized by BankInfoSecurity and NBC News:

1. Target gave network access to a third-party vendor that did not appear to follow widely accepted security practices.
2. Target appeared not to respond to multiple automated warnings from its anti-intrusion software that malware was being installed.
3. Attackers who got in with a vendor credential appeared to move from less sensitive areas to systems holding consumer data, suggesting weak isolation of sensitive assets.
4. Target appeared not to respond to warnings about the routes attackers planned to use to move data out.

BankInfoSecurity also reported the breach affected 40 million card details and personal information of 70 million customers.

What is disputed or unclear?

Fazio Mechanical issued a statement saying its connection to Target was exclusively for electronic billing, contract submission and project management, and that it did not remotely monitor or control Target's heating, cooling or refrigeration systems. Krebs's own article said it was unclear why a vendor of that kind would have network access or why it was not walled off from the payment network. That question, which applies to any vendor connection, is the useful one.

What should defenders learn?

Treat vendor access as a supply chain path. A contractor's credential is a way into your network. Limit what each vendor account can reach, require multi-factor authentication for remote access, and review who still has access. Krebs cited a Gartner analyst noting that the PCI standard at the time required two-factor authentication for third-party remote access.

Separate the networks that matter. The staff report's isolation finding says the sensitive systems were reachable from less sensitive ones. Segmentation turns a stolen credential into a smaller problem.

Give every alert an owner and a clock. The two alert findings are about response, not detection. An alert nobody is assigned to read has no value. Define who triages, how fast, and what escalation looks like.

Watch the way out. Malware on registers still had to send data somewhere. Egress monitoring and allowlists give a second chance to stop it.

How does this map to today's practice?

The same shape appears in current supply chain guidance: know your third parties, limit their access, monitor for abnormal behavior and respond. The link to software supply chain work is direct. Vendor credentials, vendor-supplied software and vendor remote tools are all dependencies on someone else's security.

What to do

1. List every third-party account with network or system access and remove the ones nobody can justify.
2. Require multi-factor authentication for vendor remote access.
3. Check that vendor accounts cannot reach payment, customer data or build systems directly.
4. Assign an owner and a response time to each class of high-severity alert.
5. Test that a detection fires and reaches a person, using a safe, authorized exercise.
6. Monitor outbound traffic from sensitive segments and alert on new destinations.

Quick check

Sources

• KrebsOnSecurity, Target Hackers Broke in Via HVAC Company, 5 February 2014
• NBC News, Target Missed Many Warning Signs Leading to Breach: Senate Report, 25 March 2014
• BankInfoSecurity, Senate Report Analyzes Target Breach, 26 March 2014

Last reviewed: 18 October 2026.