Target: the path to cash registers begins at a service provider

During year-end 2013 purchases, Target customers normally pay at the brand’s U.S. stores. However, malicious software in checkout systems collects payment data. In December, the company announced that about 40 million card accounts may have been affected.

The reenactment published by a Senate committee describes the use of stolen identifiers to a provider, and then a progression towards Target systems. The report is based on publicly available information and analysis; it should not be presented as the full and definitive forensic report of the company.

The trap is located in the paths accessible after the first connection. An account for a partner should not provide a simple path to payment processing equipment. The separation of zones and the examination of alerts become central issues.

The intercepted data is aggregated and then taken out of the network. This output is distinct from an immediate and identical debit of each card. Those affected may then experience fraud attempts, but the number of exposed cards is not a total amount actually stolen from customers.

Target investigates, removes the malware and works with payment actors and authorities. Other personal information is also concerned; populations can overlap and should not be simply added up like so many different people.

The case makes visible an often abstract idea: the security of a large network can start with the identifiers of a small company that must legitimately access it. The size of the victim does not tell where the first compromised link is.