Scourge · December 19 2013

The Scourge of the Christmas Target

Chronicle

On 19 December 2013 Target confirmed that between 27 November and 15 December, at the height of the holiday shopping season, attackers had stolen data from about 40 million credit and debit cards used in its US stores. They had entered the network with credentials stolen from an HVAC contractor, and from there reached the tills with BlackPOS malware. A later disclosure added personal data of up to 70 million customers.

Lesson learned

It taught that a supplier is a front door, that the air-conditioning network has no business seeing the tills, and that SOC alerts are meant to be read. It also sped up the move to chip cards in the US.

Prayer of reparation

O BlackPOS, who came in through the air conditioning and left through the till, segment our networks and switch off blind trust in suppliers. Amen.

How it is remembered

Remembered by separating supplier networks from payment networks, requiring MFA for anyone connecting from outside and acting on alerts instead of filing them.