Target's 2013 breach: a phished HVAC contractor as the way in

attackers sent malware-laced email to employees at Fazio Mechanical, an HVAC and refrigeration contractor, at least about two months before the card theft began. Whether this was a broad untargeted blast or a selected one is not settled in public sources: KrebsOnSecurity offered the mass-blast reading as a general pattern, "Many of these email malware attacks start with shotgun attacks", while the Senate staff report places the emails alongside attacker reconnaissance of Target's vendor ecosystem. Two of Krebs's sources named the malware as Citadel, a Zeus-derived password stealer, and both Krebs and the Senate report state this was never confirmed.

the malware ran undetected at Fazio Mechanical, whose primary anti-malware was the free, on-demand-only version of Malwarebytes, which offers no real-time protection and is licensed for individual use (investigators via KrebsOnSecurity, repeated by the Senate report). It captured the vendor's login for Target's vendor-facing systems. Which system was never established publicly: the Senate report says only that the vendor "would more than likely" have had access to Target's Ariba external billing system, on the account of one unnamed former Target security team member.

attackers triaged which infected machines were worth pursuing, and Target's own public web properties helped. The Senate report files under Reconnaissance that Target's supplier and facilities-management pages, which required no login, carried HVAC vendor files whose metadata "allowed the attacker to map Target's internal network prior to the breach."

attackers authenticated into Target-facing systems from outside using the vendor's legitimate login, entering as an apparently trusted third party rather than as an unauthorized intruder. Investigators told KrebsOnSecurity the first breach of Target's network was Nov 15, 2013.

from the low-privilege vendor-facing foothold, attackers reached more sensitive parts of Target's network. How they escalated was never established publicly. The Senate report states it is "unclear exactly how the attacker could have escalated its access from the Ariba external billing system to deeper layers of Target's internal network", and the only explanation offered anywhere is one anonymous former insider's guess that the outside portal was not fully isolated from the rest of the network.

Target's own automated intrusion-detection and anti-malware alerting tooling generated warnings as the intrusion progressed, but per the Senate staff report these alerts were not acted upon in time to stop the attack.

attackers installed RAM-scraping malware onto a small number of point-of-sale registers first to test it, then scaled it to a majority of Target's US store registers to capture card track data directly from live transactions in memory. The test-then-scale sequence appears both in the Senate report timeline and in KrebsOnSecurity's reporting from investigators.

stolen card and customer data was moved out of Target's network to external staging infrastructure. The Senate report's summary names a server in Eastern Europe; the same report and KrebsOnSecurity also describe compromised drop servers elsewhere, including in Miami and Brazil. The card data was then sold through underground card-shop markets, completing the attackers' financial objective.