Target payment card data breach disclosed during 2013 holiday season
Target disclosed unauthorized access to payment card data for guests who shopped at U.S. Target stores during the 2013 holiday season. The company reported the incident publicly and in securities filings, describing ongoing investigation and remediation. Public reporting and subsequent investigations connected the incident to substantial response costs, litigation, and payments to affected parties, though precise totals vary by accounting period and source.
First reported December 19, 2013Breachmed overall confidence
Target shoppers in the United States during the affected period
Target Corporation
Initial access
unknown
Impact
data_theft
financial_loss
Attribution
unknownlow confidence
Target’s public disclosures describe unauthorized access but do not provide definitive public attribution in the cited primary filings.
CVEs and ATT&CK
No CVE or ATT&CK association is captured in this curated record.
Mitigations
Now
Segment POS networks from corporate IT and restrict outbound egress from POS devicesLimits exposure of payment environments and makes data exfiltration from POS systems harder.
Soon
Require MFA and strong controls for third-party/vendor remote access into payment environmentsReduces risk from compromised vendor credentials being used to reach sensitive payment systems.
Later
Deploy point-to-point encryption (P2PE) and tokenization for card dataReduces value of card data if in-store systems are compromised.
Detection ideas
Monitor POS systems for unusual outbound connections and data transfer patterns
Alert on POS subnets initiating new outbound destinations, high-volume transfers, or connections to rare domains/IPs.
Data sources: Proxy logs, Firewall logs, NetFlow/flow logs
Detect unauthorized access to payment processing systems and credential reuse
Alert on logins to POS management systems from unusual hosts/accounts, especially outside change windows or from vendor VPNs.
Data sources: Windows Security Event Logs, VPN logs, EDR telemetry
