Inside Target Corp., Days After 2013 Breach
Summary: A confidential Verizon penetration test commissioned by Target days after its December 2013 breach found no controls limiting access to any system, including point-of-sale registers and servers in stores. The report, obtained by KrebsOnSecurity, says consultants cracked 472,308 of Target's 547,470 passwords (86 percent) within one week and used weak or default passwords on Microsoft SQL and Apache Tomcat servers to reach domain administrator access.
Why it matters: Attackers who took VPN credentials from HVAC vendor Fazio Mechanical faced no internal segmentation on the way to registers at more than 1,800 stores, and a federal judge has now cleared bank claims to proceed as a class action.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026