Target Security Breach Analysis

During the last Christmas season, Target announced that their data security was breached. According to David Lazarus in Los Angeles Times, Target stated that roughly 110 million customers’ information was illegally taken from their database. The information included their credit/debit card info, phone numbers, and email addresses. Target is one of the most popular grocery stores in the U.S.; they have a substantial amount of consumers. Because of this incident, consumers' trusts for the store have been decreasing. Worrying about losing its customers, the company offered a free year of credit monitoring and identity-theft protection, so the customers will feel more secure. Not only Target, some other large retailers also faced the same issues. They want their customers to trust that the companies can protect private data. However, should we not worry? Data breaches have been going on for about a decade, but we have not seriously thought about the issue. In order to protect people’s privacy, the federal government should make new laws concerning companies’ handling of customer information.

The Target Corporation has undergone many changes due to the 2013 security breach where hackers stole personal information from credit and debit cards of at least 70 million customers. Target sales and reputation has dropped from this instance, thus eliciting changes in their security systems, changes in management, and a few policy changes in handling customer information. With the public eye on the corporation’s handling of the situation, Target has been communicating these changes through various means. The changes they needed to communicate were informing customers of the security breach, addressing the bad press coverage to shareholders, downsizing of employees, and

In December of 2013, target corporation faced a serious security breach where over 40 million credit cards were stolen from different target stores. This paper is going to explore the problem, the background information about the problem, the controls that could have been in place to prevent the issue, the intended plan of control and the associated risks involved.

One of the largest examples of a technological privacy violation in history was the Target data breach of 2013. The Target Corporation is one of the leading innovators of the retail industry. They introduced the concept of designer partnerships, making them one of the leading clothing stores in the country (Corporate Target 1). Unfortunately, the company was targeted by Russian hackers shortly before the Christmas of 2013. In this hack, personal information, including customer names, mailing addresses, phone numbers, email addresses and credit card information, of seventy million people was stolen and used for fraud (Forbes 1). This has raised concerns over how well the company can ensure that their consumer’s privacy is protected.

In 2013, Target Corp., the company that prides itself on offering quality, upscale, and trendy merchandise at lower costs, had anticipated a historic year. However, after purchasing Canadian retailer Zellers’ 273 locations and finally executing plans to expand outside the United States, both company and stockholder optimism vanished. In late 2013, news of a massive data breach affecting nearly 110 million consumers turned out devastatingly bad numbers in the fourth quarter—some experts even calling it the second largest retail cyber-attack in history.

Every good company will have checks and balances in place to prevent or stop mistakes from happening. The Target company had all the industry standard security technology and had also installed a malware detection tools a few months before the breach occurred. Human error was the main fault of Target being able to be breached. Target’s management and security team both failed to respond to system warnings of malware that has been detected.

The Target data breach remains one of the most notable breaches in history, it was the first time a CEO of a major corporation was fired due to a security event. The breach received an enormous amount of attention, it caused corporations and individuals to change the way they think about information security and data protection. Between Thanksgiving and Christmas 2013 hackers gained access to 40 million customer credit cards and personal data of 70 million Target customers. The intruders slipped in by using stolen credentials and from there gained access to vulnerable servers on Targets network to launch their attack and steal sensitive customer data from the POS cash registers. All this occurred without a response from Targets security operations center, even though security systems notified them of suspicious activity. The data was then sold on the black market for an estimated $53 million dollars. However, the cost to Target, creditors, and banks exceeded half of a billion dollars. This report will review how the infiltration occurred, what allowed the breach to occur including Targets response, and finally who was impacted by the security event.

Target’s initial media communication to the public was ineffective because Target took more than 24 hours to release an announcement about the security breach after the story broke, which destroyed the corporation’s reputation and credibility. According to Eric Dezenhall, the CEO of public relations firm Dezenhall Resources, Brian Krebs reported the first story of Target’s security breach via a blog post on Dec. 18, 2013. Krebs is a national expert, former Washington Post reporter, and credible blogger who have been covering in-depth security news and investigation for more than fourteen years. Krebs alleged, during the past few days, “Target is investigating a data breach potentially involving millions of customer credit and debit card records”

Target inappropriately handled this crisis because the company waited to report the data breach until days after it initially learned about it, which gave the public the impression that Target was being dishonest. On December 15th, 2013 Target initially learned of the breach in security, and on December 19th Target confirmed the data breach to the public. In Target’s initial statement, it claimed “There is no indication that PIN numbers have been compromised on affected bank issued PIN debit cards or Target debit cards” (Steinhafel, 2013). On December 27th, Target retracted its statement, and stated, “our ongoing investigation determined that strongly encrypted PIN data was removed from our system during the data breach incident” (Target,

As technology grows and information has become a critical asset companies currently are devoted their resource and money to protect their data as important as their finance and human resource assets.

While all of these technologies have enabled exciting changes and opportunities for businesses, they have also created a unique set of challenges for business managers. Chief among all concerns about technology is the issue of information security. It seems to be almost a weekly occurrence to see a news article about yet another breach of security and loss of sensitive data. Many people will remember high profile data breaches from companies such as T.J Maxx, Boston Market, Sports Authority, and OfficeMax. In the case of T.J. Maxx, a data breach resulted in the loss of more than 45 million credit and debit card numbers. In many of these incidents, the root cause is a lack of adequate security practices within the company. The same technologies that enable managers can also be used against them. Because of this, businesses must take appropriate steps to ensure their data remains secure and their communications remain

When Target had a security breach, it became one of the top business compromises that happened. The result of the security breach leads to a $10 million settlement for the consumer $39 million to financial institution, and also awarding $19.9 million in banks’ attorney fees and costs (Bouboushian. 2016). From your post you had very detailed of how did Target got hacked, it is true that there were many mistakes that were made: the HVAC company that receive credentials for the hackers to upload the malware (5 versions), FireEye security monitor alert was ignored, Symantec Endpoint Protection warning being ignored as well, and the last thing that really impacts the final result of data breach was even the security team (experts in Bangalore)

who visited its stores during the first three weeks of the holiday season in the second-largest such breach reported by a U.S. retailer.

The analysis of 2,260 breaches and more than 100,000 incidents at 67 organizations in 82 countries shows that organizations are still failing to address basic issues and well-known attack methods. The (DBIR, 2016) shows, for example, that nearly two-thirds of confirmed data breaches involved using weak, default or stolen passwords. Also shows that most attacks exploit known vulnerabilities that organizations have never patched, despite patches being available for months – or even years – with the top 10 known vulnerabilities accounting for 85% of successful exploit “Organizations should be investing in training to help employees know what they should and shouldn’t be doing, and

It is important to note that whether an attack is perpetrated by a hacker group, other corporations or individuals, organizations must always prepare adequately through intrusion detection and prevention systems in place. Data breaches can have very devastating business and social impact to large businesses and their customers – the users. For instance, were Cloudflare attacked by a competing company, their trade secrets could have given the opponents ammunition to take them out of the field. In addition, lost data could influence criminal activity if for instance particular client information, for