In 2013 an intruder used a refrigeration contractor’s stolen login to reach Target’s registers and data on about 40 million cards. The contractor says its link was for billing. No primary record puts the HVAC system in the path.
This is not an OT incident, but it is in the book: a payment data theft in which nothing physical stopped. It is here for a pattern every plant still carries, a vendor login issued for paperwork on a network that let it reach further. The famous version gets the path wrong. The contractor said its connection was exclusively for billing, contract submission and project management, with no remote monitoring or control of heating or cooling. Our own Volume 1 page said a building automation system. The error is ours.
The architecture argument survives the correction and is stronger for it. A login issued so a small contractor could submit invoices ended, by a route even the Senate staff call unclear, at the registers. In BlastWave’s analysis, not a disclosed finding, the question is not whether a vendor gets phished, which no customer controls, but what its login can reach once it has been.
What is not known: Nobody has been publicly named or charged for the intrusion. How the credentials were stolen rests on Krebs’s sources (an email malware attack at the contractor); Target has never said. Which Target system the login opened is unpublished: Target said “the outermost portion of our network,” and Senate staff, citing a former Target employee, say an external billing system. In March 2014 Target said it was still investigating how the intruders reached the registers; no answer is public. The overlap between card and contact data is undisclosed.
Recommendation
Take the path away from vendor portals A system contractors use for invoices or paperwork reaches nothing else: not payments, not the plant, not building controls. A login to paperwork reaches paperwork.
Remove the standing vendor credential Issue vendor accounts per job, expiring with it, with the second factor held by the site owner. A stolen vendor password should open nothing on its own.
Make reporting systems report one way Registers, controllers and sensors that only send data out do it over a one-way path, so reaching the systems that collect the data reaches nothing back.
Sources: Target 10-Ks, FY2013 to FY2015; Mulligan testimony, 5 Feb and 26 Mar 2014; Fazio Mechanical statement, 6 Feb 2014; Senate Commerce majority staff report, 26 Mar 2014; NY AG multistate release, 23 May 2017. Full list with links.
Soft Spots: Phishing and Citadel are Krebs’s sourcing, not Target’s. Ariba “more than likely” is a former Target employee via Krebs, repeated by Senate staff. The “what can the login reach” lesson is BlastWave’s analysis, not a disclosed finding.
The full record
Every claim numbered to its source. Last updated .
A refrigeration contractor's stolen login reached the registers in Target's US stores, and the retelling turned the contractor's trade into the attack's route. What is verified, what is only reported, and what is still unknown.
Summary
In late 2013 an intruder used credentials stolen from one of Target's vendors, a refrigeration and HVAC contractor, to put malware on registers in its US stores, taking data on about 40 million card accounts. The contractor said its connection was for billing. No primary record we read puts the HVAC system in the path, and the attacker is undisclosed.1,2,4,10
Timeline of the Target data breach
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Intruders enter Target's network. Target told the Senate, "It appears that intruders entered our system on November 12"; Krebs's sources gave 15 November. The states say only "In November of 2013." The day is not settled.3,4,11
The card theft window in Target's 10-K. Target's written testimony to Congress gives "from November 27 through December 18." The two have not been reconciled.1,2
The Justice Department notifies Target of suspicious activity involving payment cards used at its stores.1
Target confirms malware on its point-of-sale network and removes it from virtually all registers in its US stores the same day.1
Krebs reports cards from the breach for sale on a carding shop run by a seller nicknamed Rescator.6
Target's chief financial officer tells a House subcommittee in written testimony that the intruder stole "a vendor's credentials." The same day Krebs, citing sources, names the vendor as Fazio Mechanical Services.1,11
The contractor publishes a statement that its data connection with Target was for billing, contract submission and project management. Infosecurity Magazine runs the headline "Target Hackers May Have Gotten In Through the Air Conditioner."10,12
Krebs reports, from sources, that the credentials were stolen in an email malware attack at the contractor at least two months before the card theft.5
Bloomberg Businessweek reports missed security alerts; Target says its team evaluated the activity and determined it "did not warrant immediate follow up."13,14
Target files its fiscal 2013 10-K: about 40 million card accounts, contact data for up to 70 million individuals, $61 million of pretax breach-related expenses.2
The Senate Commerce Committee majority staff publish their "kill chain" analysis. The same day Target testifies that the intruders "initially obtained an HVAC vendor's credentials to access the outermost portion of our network."4,7
Target's fiscal 2014 10-K reports $252 million of cumulative breach-related expenses, less $90 million of expected insurance recoveries: $162 million net.8
Preliminary approval proceedings in federal court in Minnesota on a $10 million consumer class settlement.15
A law firm summary reports a $67 million settlement with Visa card issuers (August 2015) and a further $39,357,939.38 for other card issuing banks.16
Target's fiscal 2015 10-K reports $39 million of breach-related costs, net of insurance, for that year.9
Forty seven states and the District of Columbia settle with Target for $18.5 million.3
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
How did the intruder get in?
With a vendor's stolen credentials; in March 2014 Target called them "an HVAC vendor's credentials"1,4
Verified
Was the HVAC system the path?
Not on any primary record read. The contractor said its link was "exclusively for electronic billing, contract submission and project management"10
Verified (contractor's statement, as republished)
Who was the vendor?
Fazio Mechanical Services, per Krebs's sources; the contractor said it was a victim too. Target never named it in anything read10,11
Reported only
How were the credentials stolen?
An email malware attack at the contractor, per Krebs's sources. Target has never said5
Reported only
Which Target system did the login open?
Target: "the outermost portion of our network." The states: a gateway server. No forensic report published3,4
Undisclosed
How did the intruder reach the registers?
"Unclear" (Senate staff). Target said in March 2014 it was still investigating4,7
Undisclosed
Card accounts taken
About 40 million (Target); more than 41 million (the states)2,3
Verified
Contact records taken
Up to 70 million individuals (Target); more than 60 million customers (the states)2,3
Verified
Who was the attacker?
Not publicly named or charged in anything found as of late September 2026
Undisclosed
Malware family
Target says point-of-sale malware; BlackPOS is a name from coverage only1
Reported only
Breach-related expenses
$252M cumulative pretax through January 2015; $162M net of expected insurance8
Verified (time-bound)
Multistate settlement
$18.5 million, 47 states and the District of Columbia, May 20173
Verified
Did hackers get into Target through the HVAC system?
No primary record we read puts the HVAC system in the path: what was stolen was an HVAC contractor's login, not access to anyone's heating or cooling. The contractor, a refrigeration and HVAC firm, published a statement on 6 February 2014, the day after it was named in the press. It said its data connection with Target "was exclusively for electronic billing, contract submission and project management," and that it does no remote monitoring or control of Target's heating, cooling and refrigeration:10
"does not perform remote monitoring of or control of heating, cooling and refrigeration systems for Target."
Target's own words, in everything read, describe credentials, not a building system. In February 2014 its chief financial officer wrote to Congress, "We now know that the intruder stole a vendor's credentials to access our system and place malware on our point-of-sale registers."1 In March he told the Senate:
"We believe that the intruders initially obtained an HVAC vendor's credentials to access the outermost portion of our network. We are still investigating how the intruders were able to move through the system using higher-level credentials."
The states' 2017 settlement release says the attackers "accessed Target's gateway server through credentials stolen from a third-party vendor."3 The trade is on Target's record; the HVAC system is not. "An HVAC contractor's stolen credentials" is accurate. "Through the HVAC system" is not. The air conditioning version was in circulation within a day of the vendor being named.12
How did the intruder get into Target's network?
With a vendor's stolen login; how it was stolen and which system it opened have never been published by Target or the states. Brian Krebs first named the vendor on 5 February 2014: "Sources close to the investigation said the attackers first broke into the retailer's network on Nov. 15, 2013 using network credentials stolen from Fazio Mechanical Services."11 Target never named the contractor in anything read; the contractor's own statement said it, like Target, was a victim of a cyber attack.10
On 12 February 2014 Krebs reported, from "multiple sources close to the investigation," that the credentials were stolen in an email malware attack at the contractor at least two months before the card theft, and named Citadel.5 That is Krebs's reporting. The Senate staff report repeats it from press reports ("Reports indicate") and says of Citadel, "this has not been confirmed."7 Target has said the intruders stole a vendor's credentials; it has never said how they were stolen.
Three descriptions of what the login opened exist, and none is a published forensic finding:
Target: "the outermost portion of our network" (26 March 2014).4
The states: "Target's gateway server" (23 May 2017).3
Senate staff, quoting a former Target security team member and footnoted to Krebs: the contractor "would more than likely have had access to Target's Ariba external billing system."5,7
They may describe different steps. The intrusion date is also unsettled: Target testified "It appears that intruders entered our system on November 12"; Krebs's sources said 15 November; the states said "In November of 2013."3,4,11
What did the Senate report on the Target breach actually find?
It is a majority staff analysis, not an investigation or a finding of fact, and it says so. Prepared for Chairman Rockefeller and published on 26 March 2014, it describes itself as "based on media reports and expert analyses," and hedges its key steps with "reportedly," "would more than likely have had access" and "It is unclear exactly how."7 Its "more than likely" is not even the staff's own inference: the sentence opens "According to a former Target security team member" and is footnoted to Krebs.5,7
"It is unclear exactly how the attacker could have escalated its access from the Ariba external billing system to deeper layers of Target's internal network."
The report also infers that Target did not properly isolate its most sensitive network assets, and says that automated alerts were not acted on; its alert findings trace to Krebs and Bloomberg Businessweek.5,7,13 On the contractor, the staff wrote that it "did not appear to follow broadly accepted information security practices," built on press reports.7 The contractor said in writing that its "IT system and security measures are in full compliance with industry practices."10 Both are printed here; neither is refereed.
Did Target ignore warnings before the breach?
Target's sworn account is that alerts were raised, logged and evaluated, and that it was asking hard questions about the judgments made; "ignored" is not on the record. In written testimony to the Senate Commerce Committee on 26 March 2014, Target's chief financial officer said "some intruder activity was detected by our computer security systems, logged and surfaced to the SOC and evaluated by our security professionals," and "we are now asking hard questions regarding the judgments that were made at that time."4
On 13 March 2014, as Bloomberg Businessweek reported the alerts, Target issued a statement to the press:13,14
"Based on their interpretation and evaluation of that activity, the team determined that it did not warrant immediate follow up."
The same statement added: "With the benefit of hindsight, we are investigating whether if different judgments had been made the outcome may have been different."14 Read with the sworn testimony, the record shows alerts that were evaluated and judged not to need immediate action at the time, which Target itself then questioned.
How much did the Target data breach cost, and what were the settlements?
Target's filings give labelled expense figures, not a single cost. Read in order:2,8,9
Fiscal 2013: $61 million of pretax breach-related expenses and $44 million of expected insurance proceeds, $17 million net ($11 million after tax, or $0.02 per diluted share). Target carried "$100 million of network-security insurance coverage, above a $10 million deductible."2
Fiscal 2014: $191 million pretax and $46 million of expected insurance proceeds, $145 million net.8
Cumulative through 31 January 2015: "$252 million of cumulative Data Breach-related expenses, partially offset by $90 million of expected insurance recoveries, for net cumulative expenses of $162 million."8
Fiscal 2015: $39 million of "Data breach-related costs, net of insurance."9
Settlements were reported separately: $18.5 million to 47 states and the District of Columbia (May 2017);3 a $10 million consumer class settlement (March 2015);15 and, per a law firm summary rather than the docket, $67 million to Visa card issuers (August 2015) and $39,357,939.38 to other card issuing banks (December 2015).16 Do not add them to the expense figures. Target's 10-K says the expenses include "an accrual for estimated probable losses" on breach claims, including card network claims, so summing the two would count some money twice. That is BlastWave's reading of the filing.8
The multistate settlement. On 23 May 2017, 47 states and the District of Columbia settled with Target for $18.5 million. The investigation was led by the Connecticut and Illinois attorneys general. The New York Attorney General's release said the states found that attackers "accessed Target's gateway server through credentials stolen from a third-party vendor" and that the credentials "were then used to exploit weaknesses in Target's system," reaching card data and "a customer service database." The settlement carried terms on segmentation and two-factor authentication.3
Who was behind the Target breach?
Nobody has been publicly named or charged for the intrusion in anything we found, as of late September 2026. No government attribution appears on the record read. On 20 December 2013 Krebs reported the stolen cards on sale at an online card shop run by a seller nicknamed "Rescator."6 That makes Rescator a seller of the cards, not a malware family, and not established as the intruder. The malware is described by Target only as malware on its point-of-sale registers; the name BlackPOS comes from coverage, not from Target.1
What is still not known about Target
Who carried out the intrusion. Nobody has been publicly named or charged in anything found as of late September 2026.
How the vendor's credentials were stolen. Krebs's sources say an email malware attack at the contractor; Target has never said.5
Which Target system the login opened. Target said "the outermost portion of our network"; the states said a gateway server; Senate staff, citing a former Target security team member, said the contractor "would more than likely have had access" to an external billing system.3,4,7
How the intruders moved from the vendor-facing system to the registers. In March 2014 Target said it was still investigating; no answer has been published.4
The exact card theft window: 27 November to 15 December 2013 in the 10-K, through 18 December in Target's testimony.1,2
The overlap between the card data and the contact data. Target's and the states' counts differ, and no de-duplicated total is published.2,3
Claims about Target the record does not support
Widely repeated claim
What the record says
"Target was hacked through its air conditioning."
A contractor's stolen login, not its HVAC work. The contractor said its link was for billing, contracts and project management, with no remote monitoring or control of heating or cooling. Target and the states say credentials.1,3,10,12
"110 million in-store customers were compromised."
Two different data sets: about 40 million card accounts and contact data for up to 70 million individuals. 110 million is a press sum; no Target filing gives a combined count.2,12
"The vendor's login reached a building automation system that bridged to the corporate network."
No primary document read puts a building automation system in the path. Target said "the outermost portion of our network"; the states said a gateway server.3,4,17
"The breach cost $309 million."
In no Target filing read. Target filed $252 million of cumulative pretax breach-related expenses through January 2015, $162 million net of expected insurance.8,17
"Rescator's malware was used in the attack."
Rescator was the carding shop Krebs reported selling the cards: a seller, not a malware family, and not established as the intruder.6,17
Including our own. Our own Volume 1 page said the attackers used the vendor's credentials to reach a building automation system that served as a bridge to the corporate network, listed the vector as "Unsecured Maintenance Remote Access," called the incident an "IT/OT convergence failure," gave a cost of $309 million and named "Rescator's Malware." None of that is supported by the primary record we read, and the errors are ours.17 We correct our own record first; it is what earns the right to correct anyone else's.
BlastWave analysis: the trade is not the route
Analysis, not a disclosed fact
This is not an OT incident, and it is in the volume anyway. No industrial process ran on the network that was breached, nothing physical stopped, and the stores kept trading while Target cleared malware from its registers. On the consequence ladder it is an IT compromise with no physical operation halted on the record: a payment data theft from a retailer. That placement is BlastWave's reading. The entry is here because it is an early, well documented case of a pattern every plant and utility still carries: a vendor issued a login for paperwork, on a network that let the login reach further than the paperwork.
The architecture argument survives the correction and is stronger for it. A login issued so a small contractor could submit invoices ended, by a route the Senate staff call unclear and Target said it was still investigating, at the registers.4,7 The lesson is BlastWave's analysis, not a disclosed finding: the question is not whether a vendor gets phished, which no customer controls, but what the vendor's login can reach once it has been.
Podcast: “The Feed Supplier's Pass” (9:35). Joe Baxter and Cam Cullen on why the question is what a vendor's login can reach, not whether the vendor gets phished.
Video: Target Short (60 to 90 seconds).
Frequently asked questions
What happened in the Target data breach?
In late 2013 an intruder used credentials stolen from one of Target's vendors to get into its network and put malware on the registers in its US stores. The Justice Department notified Target on 12 December 2013; Target confirmed the malware and removed it from virtually all US registers on 15 December, and announced the breach on 19 December. Its 10-K reported about 40 million card accounts taken.
Did hackers get into Target through the HVAC system?
No primary record we read says so. The vendor was a refrigeration and HVAC contractor, but in its statement of 6 February 2014 it said its data connection with Target was exclusively for electronic billing, contract submission and project management, and that it did no remote monitoring or control of Target's heating, cooling and refrigeration. Target and the states describe stolen credentials, not a building system.
How did the hackers get into Target's network?
Target told the Senate on 26 March 2014 that the intruders initially obtained an HVAC vendor's credentials to access the outermost portion of its network, and that it was still investigating how they moved deeper. Brian Krebs reported, citing sources, that the credentials were stolen in an email malware attack at the contractor. Target has never said how they were stolen.
How many people were affected by the Target breach?
Target's 10-K, filed in March 2014, reported approximately 40 million credit and debit card accounts and contact details for up to 70 million individuals. The states' 2017 settlement release gave more than 41 million card accounts and more than 60 million customers. These are different kinds of data, and no Target filing gives a combined count, so the often quoted 110 million is a press sum.
How much did the Target data breach cost?
Target's fiscal 2014 10-K reported $252 million of cumulative pretax breach-related expenses through January 2015, partially offset by $90 million of expected insurance recoveries, for $162 million net. Its fiscal 2015 10-K added $39 million net of insurance. Settlements, including $18.5 million to 47 states and the District of Columbia in May 2017, were reported separately and should not be added to those expenses.
Who was behind the Target breach?
Nobody has been publicly named or charged for the intrusion in anything found as of late September 2026. Brian Krebs reported in December 2013 that the stolen cards were sold on a carding shop run by a seller nicknamed Rescator, which makes Rescator a seller of the cards, not a malware family and not an established intruder.
Did Target ignore warnings before the breach?
Target told the Senate Commerce Committee on 26 March 2014 that some intruder activity was detected, logged, surfaced to its security operations center and evaluated, and that it was asking hard questions about the judgments made. In a 13 March 2014 statement it said its team determined the activity did not warrant immediate follow up, and that with hindsight it was investigating whether, had different judgments been made, the outcome may have been different.
Is the Target breach an OT security incident?
No. No industrial process or control system was involved, nothing physical stopped, and the stores kept trading. BlastWave includes it in Hackopedia because it is an early, well documented case of a vendor's login, issued for billing and paperwork, becoming the way into a customer's core network, which is an access pattern operational technology sites still carry.
Primary sources are Target's SEC filings and written testimony to Congress, the contractor's own statement, the state attorneys general's settlement release and the court record. The Senate staff report is a staff analysis built on press reports, and press is cited only as evidence of what was said.
Sworn testimonyJohn J. Mulligan, Executive Vice President and Chief Financial Officer, Target Corporation, written testimony, House Committee on Energy and Commerce, Subcommittee on Commerce, Manufacturing, and Trade, 5 February 2014. PDF
Company filingTarget Corporation, Form 10-K for the fiscal year ended 1 February 2014, filed 14 March 2014 (accession 0000027419-14-000014). sec.gov
GovernmentNew York Attorney General, "A.G. Schneiderman Announces $18.5 Million Multi-State Settlement With Target Corporation Over 2013 Data Breach," 23 May 2017 (investigation led by the Connecticut and Illinois attorneys general).
Sworn testimonyJohn J. Mulligan, written testimony, Senate Committee on Commerce, Science, and Transportation, hearing "Protecting Personal Consumer Information from Cyber Attacks and Data Breaches," 26 March 2014. PDF
PressBrian Krebs, "Email Attack on Vendor Set Up Breach at Target," Krebs on Security, 12 February 2014. Reporting from unnamed sources; cited as evidence of what was reported. krebsonsecurity.com
PressBrian Krebs, "Cards Stolen in Target Breach Flood Underground Markets," Krebs on Security, 20 December 2013. krebsonsecurity.com
GovernmentUS Senate Committee on Commerce, Science, and Transportation, Majority Staff Report for Chairman Rockefeller, "A 'Kill Chain' Analysis of the 2013 Target Data Breach," 26 March 2014. A staff analysis "based on media reports and expert analyses," not a finding of fact. PDF
Company filingTarget Corporation, Form 10-K for the fiscal year ended 31 January 2015, filed 13 March 2015 (accession 0000027419-15-000012). sec.gov
Company filingTarget Corporation, Form 10-K for the fiscal year ended 30 January 2016, filed 11 March 2016 (accession 0000027419-16-000043). sec.gov
CompanyFazio Mechanical Services, Inc., statement by Ross E. Fazio, President, 6 February 2014, as republished by SC Media and in Krebs on Security's update of the same date. The two republications agree word for word on the sentences quoted here; the original company web page was not retrieved. scworld.com · Krebs on Security update
PressBrian Krebs, "Target Hackers Broke in Via HVAC Company," Krebs on Security, 5 February 2014, with a 6 February update republishing the contractor's statement. Reporting from unnamed sources; cited as evidence of what was reported. krebsonsecurity.com
PressInfosecurity Magazine, "Target Hackers May Have Gotten In Through the Air Conditioner," 6 February 2014. Cited as evidence of the circulating version. infosecurity-magazine.com
PressBloomberg Businessweek, "Missed Alarms and 40 Million Stolen Credit Card Numbers: How Target Blew It," 13 March 2014. Cited as evidence of what was reported.
PressNBC News, "Target Warned of Hack But Didn't Immediately Respond: Report," 13 March 2014, carrying Target's statement in full. Cited as evidence of what Target said to the press. nbcnews.com
Court recordUS District Court for the District of Minnesota, In re Target Corporation Customer Data Security Breach Litigation, MDL No. 14-2522, preliminary approval proceedings on the consumer class settlement, 19 March 2015. PDF
PressMintz, "Target and Card Issuers Reach Final Data Breach Settlement," 1 December 2015. A law firm summary, not the court docket or a Target release. mintz.com
CompanyBlastWave, Hackopedia Volume 1, "Target HVAC Vendor Breach (2013)," live page read 24 September 2026. Cited as evidence of what we published; corrected by this entry. hackopedia.blastwave.com
Cite this page
BlastWave. “Target Data Breach (2013): What Is Verified.” Hackopedia, Volume 2, FILE 011. Last verified 28 September 2026. https://hackopedia.blastwave.com/food-beverage-retail/target-2013/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 011 in Hackopedia Volume 2, in the Food, Beverage and Retail edition.
28 Sep 2026
Hand-check against the primary record: the fiscal 2015 breach cost line confirmed in Target's 10-K on EDGAR, the $10 million consumer settlement confirmed in the court record, Target's 13 March 2014 statement on the alerts confirmed as printed by NBC News, and Krebs's December 2013 Rescator report and the Infosecurity Magazine headline read at source. Cross-entry consistency review; the label on the expense figures restored in the summary.
26 Sep 2026
Full validation of every figure, date and quotation. Added Target's 26 March 2014 Senate testimony describing "an HVAC vendor's credentials" and "the outermost portion" of its network; attributed the Senate staff report's "more than likely" to the former Target security team member it cites; removed a statement that costs after 2015 were undisclosed, since later cumulative figures were reported.
24 Sep 2026
Volume 2 entry built from primary sources. Corrected Volume 1 errors: the building automation bridge, the maintenance remote access vector, the IT/OT convergence label, the $309 million cost and Rescator named as malware.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
