Target Hackers Broke in Via HVAC Company
Summary: Sources told KrebsOnSecurity that attackers entered Target's network on Nov. 15, 2013 using network credentials stolen from Fazio Mechanical Services, a Sharpsburg, Penn.-based refrigeration and HVAC subcontractor that had worked at Target and other retailers. Between Nov. 15 and Nov. 28 the intruders uploaded card-stealing malware to a small number of cash registers to test it, then pushed it to a majority of Target's point-of-sale devices by the end of the month, with Target reporting roughly 40 million card accounts exposed between Nov. 27 and Dec. 15, 2013.
Why it matters: A vendor login meant for billing and project management became the path to 40 million card records, and Gartner analyst Avivah Litan estimated Target could face losses of up to $420 million, before the $100 million its CFO said chip-and-PIN upgrades could cost.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026