1. The hackers used a pretty common strategy but on a very large scale. First, they gained access
to Target’s network by stealing login credentials from one of Target’s vendors, an HVAC
company that had remote access to Target’s systems. The hackers got the username and
password through a phishing email that an employee from that company responded to. Once they
had those credentials, they were able to log into Target’s network remotely and start exploring
the system. After getting inside the network, the attackers slowly moved through different parts
of Target’s IT infrastructure until they reached the payment system connected to the store’s
point-of-sale terminals. From there they installed malware on about 1,800 payment terminals.
This malware was designed to capture credit and debit card data when customers swiped their
cards during purchases. The stolen information was temporarily stored on Target’s own servers
and then transferred to external servers controlled by the hackers. Eventually the data was sent to
servers overseas and later sold on black market websites where criminals could buy batches of
stolen card numbers.
2. Several different factors made this breach possible. One major issue was the vulnerability
created by third-party vendors. Because the HVAC company had access to Target’s network, the
hackers were able to get into the system through that connection once they stole the login
information. This shows how security problems can sometimes come from outside partners
rather than the company itself. Another important factor was that Target actually had advanced
security tools that detected suspicious activity, but the alerts were not handled properly. The
company had installed a monitoring system that generated warnings when unusual behavior was
detected in the network. However, employees did not respond to these warnings quickly enough,
and some security features had even been turned off because the system was new and the team
did not fully trust it yet. Because of this, the attackers were able to keep operating in the system
without being stopped. Large companies, like Target, have complicated IT systems with many
different connections, which can make it easier for hackers to move through the system once
they gain access. Even though Target had multiple layers of security, the attackers were still able
to exploit small weaknesses and eventually reach the payment system where customer card data
was processed.
3. The consequences of the breach affected many different groups. For customers, the biggest
issue was that their personal and financial information was stolen. Many people had to cancel
their cards, deal with fraudulent charges, and worry about identity theft. Even if nothing
happened to their accounts, customers still had to spend time monitoring their credit and
replacing cards, which created a lot of frustration. Financial institutions were also heavily
impacted. Banks had to cancel and replace millions of debit and credit cards, which created
significant costs and logistical challenges. In many cases the banks were responsible for handling
fraud claims and managing the security issues caused by the breach.Target itself experienced
serious financial and reputational damage. The company faced a large drop in profits and sales,
partly because customers were nervous about shopping there after the breach. Target also had to
spend a lot of money responding to the crisis, including customer support, legal costs, security
improvements, and credit monitoring services for affected customers. On top of that, the breach
led to major leadership changes, including the resignation of the company’s Chief Information
Officer and later the departure of the CEO. The company also faced many lawsuits from banks,
customers, and shareholders seeking damages related to the breach.