Target Hit in the Bullseye

Retailers have seen major increases in cyber-attack. Point of sale systems, vendor and supplier connected portals, even on-site system administrators, pose potential risks. All of these potential weak links in the chain came to light when Target got hit in the bullseye, beginning on the biggest US shopping day, Black Friday, of the year 2013.

The cyber-attack on Target hit all of the wrong numbers, (or right, depending on your point of view):

• 41 million customers’ credit card information stolen
• $200 million estimated cost to banks and credit unions over replaced cards and disputed charges (which Target settled for $39 million)
• An estimated 46% dip in profitduring the biggest shopping period of the season
• An $18.5 million recent multi-state lawsuitsettlement with consumers

All told, Target lost an estimated $300 million and became a case study for security vendors in economic impact, security risks, and response actions. Now that enough time has passed to really drill-down on what happened, security researcher Brian Krebs reported that the attack, “appears to have begun with a malware-laced email phishing attack sent to employees at an HVAC firm that did business with the nationwide retailer.” That’s right, a phishing attack against an unsuspecting HVAC guy may have cost a fortune to one of the largest retailers in the United States.