NuData Security
  • Solutions
    • NuDetect for Continuous Validation
    • NuDetect for Good User Validation
    • NuDetect for Account Takeover
    • NuDetect for Card Testing
    • NuDetect for OAO
    • Smart Interface 3DS 2.0
    • Trusted Device
  • How It Works
    • Layers
      • Device Intelligence
      • Behavioral Analytics
      • Passive Biometrics
      • Trust Consortium
    • Interdictions
    • Integration
    • Connected Intelligence
  • Use Cases
    • Account Takeover
    • Good User Validation
    • Card Testing
    • Automated Attacks
    • New Account Fraud
    • Loyalty Fraud
    • Success Stories
  • Industries
    • Banking & Financial
    • eCommerce
    • Digital Goods
    • Healthcare
  • Resources
    • Articles
    • Blog
    • Brochures & Datasheets
    • Case Studies
    • Infographics
    • Videos
    • Webinars
    • White Papers & Reports
    • COVID Resources
    • FAQ
  • Company
    • Privacy by Design
    • Awards & Accolades
    • Careers
    • Events
    • News
    • Partners
    • Press Releases
  • Contact Us
  • Demo
  • Search
  • Menu
  • Twitter
  • Linkedin
  • Youtube
Target logo

Target’s Security Slip — 110 Million Customers’ Information Stolen

Target’s Black Friday season security mishap put a harsh spotlight on consequences of less that stone-clad data security.  It also demonstrated the comparative ease with which hackers can gain access to consumer data. The attack was made possible due to a malicious software which infected Target’s point-of-sale systems, resulting in the theft of customers’ names, phone numbers, email addresses, and mailing addresses in addition to their credit and debit card numbers. 

The Method of Attack

With data security a hot topic in the mainstream news thanks to revelations regarding the NSA and GCHQ surveillance of citizens, the attack couldn’t have come at a worse time for Target’s reputation.  Another confounding factor: the software allegedly used to obtain the information is described as “off-the-shelf” malware.  Called “BlackPOS,” the memory-scraping software is designed to capture consumer data immediately after it is gathered by the point-of-sale system.

While a publicly released statement regarding the method of infection has not been released, sources claim that BlackPOS was introduced to the system via a compromised Target Web server and installed on the POS system.  The scavenged data was then deposited via a control server on Target’s internal network, to which the hackers appeared to have had constant access.

The Attackers

The perpetrators of the attack have not been positively identified but the ongoing investigation has revealed some telling information.  BlackPOS was authored by a hacker who goes by the nickname Wagner Richard on Vkontakte.ru, a Russian social network.  The malware was sold via criminal forums, and the stolen data was bundled and put up for sale on the black market.

The Consequences

The data stolen was more than sufficient for criminally-minded buyers to create working counterfeit credit and debit cards.  At least one couple has been charged with fraud for using credit cards created with data from the Target breach.  Mary Carmen Garcia and Daniel Guardiola Domenguez of Monterrey, Mexico were stopped in January after a Texas shopping spree.  Investigators believe this points to the purchase of some customers’ data by Mexican criminal organizations. However, at this time there is no reason to believe that hackers could have access to the PINs from the compromised debit cards, making ATM-oriented theft unlikely. The PINs were included in theft were but were encrypted.

It’s equally unlikely that sale of the data was restricted to a single organization located in Mexico, as the availability of it on the black market means that any number of criminal organizations and individuals around the world may have gained access.

The PR Blitz

After being criticized by some for lagging in their announcement, Target launched an aggressive PR campaign to earn back the trust of its customers, contacting directly those for whom they had email addresses, offering a year of credit monitoring to affected customers, and stressing their commitment to future security.

Going Forward

Could the attack have been prevented? Until more is known about the security failing that led to Target’s central systems, it’s difficult to say.  As a major retailer, Target would have been PCI (Payment Card Industry standard) compliant, which means it is all the more unsettling that a cheap ($1,800-$2,300) piece of software like BlackPOS was so effective. Retailers who have relied strictly on being PCI standard compliant should take note of the retail giant’s plight.  Security experts maintain that PCI standards are a good foundation, but that retailers need to examine their information security programs and institute more comprehensive protection.

Share this entry
  • Share on Facebook
  • Share on Twitter
  • Share on Google+
  • Share on Pinterest
  • Share on Linkedin
  • Share on Tumblr
  • Share on Reddit
  • Share by Mail
https://nudatasecurity.com/wp-content/uploads/2014/01/Target-logo.png 226 999 NuData https://nudatasecurity.com/wp-content/uploads/2017/12/Nudata_logo-300x112.png NuData2014-01-22 10:14:392016-08-22 11:10:44Target’s Security Slip — 110 Million Customers’ Information Stolen
18h

Read here: March is #FraudPreventionMonth and the best way to …

2 Mar

Read here: How many unique passwords do your users have? …

2 Mar

Read here: The economic instability, social unrest and operational disruptions …

25 Feb

Read here: How does designing accessible security relate to a …

24 Feb

Read here: Physical limitations, economic barriers, and low digital literacy …

Solutions

  • Solutions
  • NuDetect for Continuous Validation
  • NuDetect for Account Takeover
  • Success Stories

Company

  • Company
  • News
  • Press Releases
  • Events
  • Awards & Accolades
  • Partners
  • Careers

Use Cases

  • Use Cases
  • Account Takeover
  • Good User Validation
  • Automated Attacks
  • New Account Fraud
  • Loyalty Fraud

Industries

  • Industries
  • Banking & Financial
  • eCommerce
  • Digital Goods

Resources

  • Resources
  • Articles
  • Blog
  • Brochures & Datasheets
  • Infographics
  • Videos
  • Webinars

Contact us

Still have questions?

Call: +1 (604) 800-3711
Twitter Linkedin Newsletter Youtube
© Mastercard Technologies Canada ULC 2021 - Terms of Service - Privacy Policy
Scroll to top