Published: 19 October 2020    Last Updated: 03 July 2023

Target were breached in 2013. The story was initially broken by Brian Krebs in a post published on 18 December 2013 and titled “Sources: Target investigating Data Breach”. This was followed up by a statement from Target announcing the breach on 19 December. The target confirmation stated the breach lasted between November 27 and December 15.

The breach was achieved through first compromising Target’s HVAC vendor, Fazio Mechanical. This was achieved through a phishing email which deployed malware which targeted credentials. These credentials were then used to access Target’s network.