Documented incidentDisclosed 2013-12-19TargetEngineering postmortem

Payment card data for about 40 million accounts taken from Target's U.S. stores (2013)

HVAC vendor portal credentials lacked two-factor authentication; attackers pivoted into internal networks and pushed BlackPOS memory scrapers to 1,800 checkout terminals.

The failure pattern

Weak or phishable authentication on a privileged pathA password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.How to prevent it Insufficient segmentation lets a foothold spreadOne compromised account, vendor or network segment reaches management planes, backups and everything else.How to prevent it
Watch the pattern: Weak or phishable authentication on a privileged path

Safeguards that address it

CollectSEA's engineering analysis of what would have prevented or contained this failure.

  • Constrain third-party vendor accessRequire MFA for vendor portals, scope access to only what the vendor needs and segment vendor networks from payment systems.
  • Monitor point-of-sale software integrityDetect unexpected binaries on terminals and unusual outbound data flows.

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern