Target's APT Kill Chain Attack Model

Even though Target is ranked currently 36 in the fortune 500 companies and have over 1750 stores, they are still very susceptible to being a victim of a cyber attack. In 2013, Target fell victim to a security breach on their system. Roughly around Thanksgiving of 2013, someone had installed malware in Target’s security and payment system enabling the hackers to steal credit card and personal information. “Six months earlier the company began installing a $1.6 million malware detection tool made by the computer security firm FireEye, whose customers also include the CIA and the Pentagon.” (BloombergBusiness) In place was a very effective security system. However, when the attacked happen on November 30, FireEye spotted the hackers and Bangalore (a third party cyber security company hired by Target) that alerted the IT team at corporate office in Minneapolis. There was no response from Target’s Corporate IT team and therefore led to 40 million credit card numbers and 70 million addresses, phone numbers and other personal

Even though Target is ranked currently 36 in the fortune 500 companies and have over 1750 stores, they are still very susceptible to being a victim of a cyber attack. In 2013 Target fell victim to a security breach on their system. Roughly around Thanksgiving of 2013 someone had installed malware in Target’s security and payment system enabling the hackers to steal credit card and personal information. “Six months earlier the company began installing a $1.6 million malware detection tool made by the computer security firm FireEye, whose customers also include the CIA and the Pentagon.” (BloombergBusiness) In place was a very effective security system, but when the attacked happen on November 30, FireEye spotted the hackers and Bangalore, a third party cyber security company hired by Target alerted the IT team at corporate office in Minneapolis. There was no response from Target’s Corporate IT team and therefore led to the 40 million credit card numbers and 70 million addresses, phone numbers

The Target Corporation has undergone many changes due to the 2013 security breach where hackers stole personal information from credit and debit cards of at least 70 million customers. Target sales and reputation has dropped from this instance, thus eliciting changes in their security systems, changes in management, and a few policy changes in handling customer information. With the public eye on the corporation’s handling of the situation, Target has been communicating these changes through various means. The changes they needed to communicate were informing customers of the security breach, addressing the bad press coverage to shareholders, downsizing of employees, and

Specify the red flag(s) that Target overlooked or ignored before the retail attack and give your opinion as to why Target overlooked or ignored the red flag(s).

“The breach at Target Corp. that exposed credit card and personal data on more than 110 million consumers appears to have begun with a malware-laced email phishing attack sent to employees at an HVAC (heating, ventilation and air conditioning) firm that did business with the nationwide retailer […].”

During the dates of November 27 through December 2013, the department store Target experienced a data breach in which approximately 40 million customers credit and debit cards were exposed. During this breach, customer’s personal information may have also been exposed for use of possible fraud. January

The Home Depot and Target have been one of the many retail establishments cyber attack breaches that have being targeted by cyber attackers. The Home Depot was the target of a cyberattack payment card system breach where their credit card information was basically stolen on September of 2014. The attacked occurred by attackers gaining third party credentials in order to gain access to the system, after they gained access to the system they weakened the system gaining their own access privileges. After doing all the mentioned above, malware was installed quickly on Home Depot’s self-check-out system. All these steps where taking by the cyber attackers resulting in the loss of more than fifty million credit card accounts and email addresses.

One of the largest issues with this data breach is, just six months prior, Target had installed “a $1.6 million malware detection tool made by the computer security firm FireEye (FEYE), whose customers also include the CIA and the Pentagon” (Riley, Elgin, Lawrence, & Matlack, 2014). The problem was not the software, it was a lack of reaction by Target’s security team located in Minneapolis. Once the credit card and personal information was stored, the hackers moved the information to various locations throughout the U.S. before sending the data to their computers in Russia. On December 12, 2013, Federal investigators notified Target of a massive data breach; and on December 15, 2013, Target confirmed and eradicated the malware, after all of the credit card and personal information had been stolen.

This section primarily attempts to provide a better understanding as to how the 2013 data breach impacted Target’s finances. Because the breach occurred within Target’s fourth quarter 2013 period—between November 2, 2013, and February 1, 2014—financial analysis was gathered primarily from information provided in Target’s 2013 quarterly reports, 2012 and 2013 annual reports. This analysis will be divided into four parts. The first is an analysis of the company’s quarterly revenues and net earnings and how it measures year-over-year. The second assesses the company’s profitability through ratio analysis. The third segment gauges Target’s 2013 fiscal year performance with that of its biggest competitor, Walmart. The fourth and final segment looks at whether or not Target was able to regain its customers in the years that followed.

In 2013, Target Corp., the company that prides itself on offering quality, upscale, and trendy merchandise at lower costs, had anticipated a historic year. However, after purchasing Canadian retailer Zellers’ 273 locations and finally executing plans to expand outside the United States, both company and stockholder optimism vanished. In late 2013, news of a massive data breach affecting nearly 110 million consumers turned out devastatingly bad numbers in the fourth quarter—some experts even calling it the second largest retail cyber-attack in history.

The following day they deployed their card stealing malware onto the POS systems. On December 11 the attackers are first discovered and on the 15th of December they were removed from the network. December 19th Target acknowledge the breach to the public and details started coming to light on the sophistication of the attack (Jarvis & Milletary, 2014).

The Target data breach remains one of the most notable breaches in history, it was the first time a CEO of a major corporation was fired due to a security event. The breach received an enormous amount of attention, it caused corporations and individuals to change the way they think about information security and data protection. Between Thanksgiving and Christmas 2013 hackers gained access to 40 million customer credit cards and personal data of 70 million Target customers. The intruders slipped in by using stolen credentials and from there gained access to vulnerable servers on Targets network to launch their attack and steal sensitive customer data from the POS cash registers. All this occurred without a response from Targets security operations center, even though security systems notified them of suspicious activity. The data was then sold on the black market for an estimated $53 million dollars. However, the cost to Target, creditors, and banks exceeded half of a billion dollars. This report will review how the infiltration occurred, what allowed the breach to occur including Targets response, and finally who was impacted by the security event.

In December 2013, Target was attacked by a cyber-attack due to a data breach. Target is a widely known retailer that has millions of consumers flocking every day to the retailer to partake in the stores wonders. The Target Data Breach is now known as the largest data breach/attack surpassing the TJX data breach in 2007. “The second-biggest attack struck TJX Companies, the parent company of TJMaxx and Marshall’s, which said in 2007 that about 45 million credit cards and debit cards had been compromised.” (Timberg, Yang, & Tsukayama, 2013) The data breach occurred to Target was a strong swift kick to the guts to not only the retailer/corporation, but to employees and consumers. The December 2013 data breach, exposed Target in a way that many

After reading the article about the Target data security breach and how Target handled the PR, I agree with the author’s stance on how bad Target handled the PR of the data security breach. Target didn’t tell anyone about the data security breach even though they knew, instead someone else broke the story. Target did the opposite of the five principles of crisis communication, Target knew about the issue but wasn’t prepared to go public with it or communicate the issue with the press and other constituencies, and be honest to the public about what is going on. Instead, somebody else had to break the news. Also, Target wasn’t clear what it was doing to remedy the issue and didn’t mean it instead Target states the typical speech every company makes “we are taking this issue seriously”.

Point-of-sale terminals infected resulting in massive breaches. Another pattern, purpose of-offer (PoS) based malware has been the principle benefactor in Mastercard breaks in the previous four years – starting with Target and Home Depot. These breaks were the first to convey light to this pattern and recognize that cybersecurity experts expected to stay ready and careful. This pattern, the focusing of purpose of-offer terminals is a consequence of a couple of dubious components. As indicated by Chester Wisniewski, essential research researcher at Sophos, PoS sellers, "instead of attempting to secure PoS terminals and programming accurately, just disregard the issue and let the traders turn into the casualties" (Winder, 2016, para. 4). Moreover, he tends to the way that most merchants who oversee and offer terminals have not tried to refresh their security for over 20 years