Incident: Target Data Breach: Massive Cyberattack on Customer Information.

Published Date: 2013-12-19

Postmortem Analysis
Timeline 1. The software failure incident at Target, where hackers stole data of millions of customers, occurred between November 27 and December 15, 2013, as reported in Article [55781]. 2. The Dunkin' Donuts data breach incident affecting nearly 20,000 people in the loyalty program started as early as 2015, according to the lawsuit mentioned in Article [89337].
System 1. Target's security system and response mechanisms [23820, 59289, 25157, 25158, 55781] 2. FireEye Inc security system [25158] 3. DD Perks loyalty program security measures [89337]
Responsible Organization 1. Hackers targeted Target's point-of-sale terminals, leading to a massive data breach affecting millions of customers [23820, 59289, 25157, 55801]. 2. Overseas hackers were responsible for the cyber attack on Target, compromising up to 40 million payment cards during the holiday shopping season [55781]. 3. Hackers targeted Dunkin' Donuts and stole account credentials from the DD Perks loyalty program, affecting nearly 20,000 people [89337].
Impacted Organization 1. Target customers [23820, 59289, 55781] 2. Dunkin' Donuts customers [89337]
Software Causes 1. Malware being installed on Target's system and attackers planning escape routes for stolen data, which were not responded to by Target [25157]. 2. Security software detecting potentially malicious activity during the data breach but staff deciding not to take immediate action [25158]. 3. Hackers targeting Dunkin' Donuts and stealing account credentials through credential stuffing, leading to cyberattacks on the DD Perks loyalty program [89337].
Non-software Causes 1. Lack of proper response to warnings about malware being installed on the system and attackers planning escape routes [Article 25157]. 2. Failure to take immediate action despite security software detecting potentially malicious activity during the data breach [Article 25158]. 3. Delay in notifying the public about cyberattacks and data breaches, violating data breach notification laws [Article 89337].
Impacts 1. The software failure incident at Target resulted in the theft of personal information, including names, mailing addresses, phone numbers, email addresses, and debit and credit card data of as many as 110 million customers [23820, 59289]. 2. Target faced significant financial impacts, including paying $18.5 million to 47 states and the District of Columbia as part of a settlement with state attorneys general over the security breach [59289]. 3. The breach led to Target spending $202 million on legal fees and other costs since the incident [59289]. 4. Target's CEO, Gregg W. Steinhafel, resigned in May 2014 due to the failure incident [59289]. 5. The breach resulted in potential class-action lawsuits and action from banks seeking reimbursement for losses due to fraud and the cost of card replacements [25157]. 6. The stolen credit card information from Target was being sold in online black markets for as little as $20 a batch [55781]. 7. Dunkin' Donuts faced a lawsuit for failing to disclose a data breach in 2015, affecting nearly 20,000 people who had signed up for the company's loyalty program [89337].
Preventions 1. Implementing proper security measures and responding to automated warnings promptly could have prevented the software failure incident at Target [Article 25157]. 2. Tightening digital security, maintaining software and encryption programs, and separating cardholder data from the rest of the network could have helped prevent the breach at Target [Article 59289]. 3. Taking immediate action upon detecting potentially malicious activity, such as malware, could have mitigated the impact of the data breach at Target [Article 25158]. 4. Enhancing security protocols, monitoring for unusual activity, and addressing vulnerabilities in the system could have prevented the cyberattacks on Dunkin' Donuts' loyalty program [Article 89337].
Fixes 1. Implementing stronger security measures to prevent future breaches, such as enhancing network security, monitoring for suspicious activities, and promptly responding to alerts [Article 25157]. 2. Conducting regular security assessments and audits to identify vulnerabilities and address them proactively [Article 25158]. 3. Enhancing employee training on cybersecurity best practices to prevent phishing attacks and improve overall security awareness [Article 55781]. 4. Improving incident response protocols to ensure immediate action is taken upon detection of potential security threats [Article 25158]. 5. Enhancing customer data protection by encrypting sensitive information and implementing measures to prevent unauthorized access [Article 89337].
References 1. Target Corp [23820, 59289, 25157, 55801, 25158] 2. U.S. Senate staffers [25157] 3. Commerce, Science and Transportation Committee [25157] 4. John Mulligan, Target’s executive vice president and chief financial officer [25157] 5. Edith Ramirez, chairwoman of the Federal Trade Commission [25157] 6. Bloomberg Businessweek [25158] 7. FireEye Inc [25158] 8. Visa [55801] 9. Brian Krebs, reporting for KrebsOnSecurity.com [55781] 10. New York Attorney General Letitia James [89337]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) In the case of Target, a similar software failure incident happened again within the same organization. Target experienced a massive data breach in 2013, where cybercriminals accessed customers' private information at point-of-sale terminals, resulting in the theft of names, mailing addresses, phone numbers, email addresses, and debit and credit card data of customers [23820]. This incident led to a settlement with state attorneys general, where Target agreed to pay $18.5 million and enhance its digital security measures [59289]. Additionally, a report revealed that Target missed multiple opportunities to prevent the hackers responsible for the breach and did not respond to warnings about malware being installed on its system [25157]. Furthermore, it was disclosed that Target's security software detected potentially malicious activity during the breach, but the staff decided not to take immediate action, raising questions about the handling of security alerts [25158]. (b) The incident at Dunkin' Donuts also highlights a similar software failure happening at another organization. Dunkin' Donuts faced a data breach in 2015 affecting nearly 20,000 people who had signed up for the company's loyalty program. The company failed to protect its customers and knew about cyberattacks for years before notifying the public, violating data breach notification laws [89337]. The hackers targeted Dunkin' and stole account credentials from the DD Perks loyalty program, leading to the sale of stolen information on the dark web. Dunkin' staff received complaints about hacked accounts in 2015, but the company did not take proper security measures or notify the public until late 2018, after more than 300,000 accounts had been compromised.
Phase (Design/Operation) design, operation (a) In the software failure incident related to the Target data breach, it was reported that Target missed multiple opportunities to thwart the hackers responsible for the breach. The U.S. Senate staffers charged that there were warnings about malware being installed on Target's system, but the company did not respond to these warnings, indicating a failure in the design phase of the system [Article 25157]. (b) The failure in the operation phase of the system was evident in the Dunkin' Donuts data breach incident. Dunkin' Donuts failed to protect the security of its customers' data and did not disclose a data breach affecting nearly 20,000 people who had signed up for the company's loyalty program. The company knew about cyberattacks for years but did not warn the public, showcasing a failure in the operation or misuse of the system [Article 89337].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident at Target was primarily due to contributing factors that originated from within the system. The breach occurred due to malware being installed on Target's system, which the company failed to respond to despite receiving warnings from its anti-intrusion software [Article 25157]. Additionally, Target's security software detected potentially malicious activity during the breach, but the staff decided not to take immediate action, leading to the compromise of millions of customer data records [Article 25158]. (b) outside_system: The software failure incident at Target was also influenced by contributing factors that originated from outside the system. The cybercriminals responsible for the breach were overseas hackers who targeted Target's system, compromising up to 40 million payment cards during the holiday shopping season [Article 55781]. Additionally, in the Dunkin' Donuts case, hackers targeted the DD Perks loyalty program, stealing account credentials through credential stuffing, a method that involves using passwords from other breaches [Article 89337].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The software failure at Target was primarily due to a cyber attack by hackers who accessed customers' private information at point-of-sale terminals during check-out, resulting in the theft of personal information and credit card data [23820]. - Target's security software detected potentially malicious activity during the data breach, but the staff decided not to take immediate action, leading to the compromise of payment card records and customer information [25158]. - The data breach at Dunkin' Donuts was caused by hackers targeting the DD Perks loyalty program and stealing account credentials, leading to the theft of personal information and account details [89337]. (b) The software failure incident occurring due to human actions: - Target missed multiple opportunities to thwart the hackers responsible for the data breach, as the company ignored warnings about malware being installed on its system and failed to respond to automated warnings about the attackers' activities [25157]. - Target's security team received alerts about malicious software in the system but did not take immediate action, leading to the compromise of payment card records and customer information [25158]. - Dunkin' Donuts failed to protect its customers by not disclosing the data breach in a timely manner, despite knowing about cyberattacks targeting the DD Perks loyalty program since 2015, which resulted in the theft of account credentials and personal information [89337].
Dimension (Hardware/Software) software (a) The software failure incident occurring due to hardware: - There is no specific mention in the provided articles about the software failure incident at Target being caused by hardware issues. The focus of the incidents is primarily on cyberattacks, data breaches, and security vulnerabilities rather than hardware-related failures. (b) The software failure incident occurring due to software: - The software failure incidents at Target were primarily due to contributing factors originating in software, specifically related to cyberattacks, malware, and security vulnerabilities. The incidents involved hackers gaining unauthorized access to Target's system, installing malicious software, and stealing customer data [23820, 59289, 25157, 55801, 25158, 55781].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident at Target was malicious in nature. Hackers accessed customers' private information at point-of-sale terminals during check-out, resulting in the theft of names, mailing addresses, phone numbers, email addresses, and debit and credit card data of people who shopped at the retailer [23820]. The cyberattack compromised up to 40 million payment cards during the holiday shopping season, with stolen credit card information being sold in online black markets [55781]. The attackers stole account credentials from Dunkin' Donuts' loyalty program, targeting the DD Perks program and selling the stolen information on the dark web [89337]. (b) The software failure incidents were non-malicious. Target missed multiple opportunities to thwart the hackers responsible for the data breach, indicating failures in responding to warnings and automated alerts about malware being installed on the system [25157]. Target's security software detected potentially malicious activity during the data breach, but the staff decided not to take immediate action, leading to the compromise of payment card records and customer information [25158]. Dunkin' Donuts failed to protect its customers' data and disclose a data breach affecting nearly 20,000 people who signed up for the loyalty program, with hackers targeting the program through credential stuffing [89337].
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) poor_decisions: 1. Article 25158 mentions that Target's security software detected potentially malicious activity during the data breach but the staff decided not to take immediate action. The security team received alerts about malware being installed but did not respond adequately to prevent the breach [25158]. 2. The same article highlights that Target failed to respond to multiple automated warnings from its anti-intrusion software regarding the installation of malicious software and the planning of escape routes for stolen information. Additionally, Target gave network access to a third-party vendor that did not follow accepted information security practices [25158]. (b) accidental_decisions: 1. Article 55781 mentions that hackers targeted Dunkin' Donuts and stole account credentials from the DD Perks loyalty program through credential stuffing, a method where hackers use passwords from other breaches. This accidental decision by customers to reuse passwords across multiple accounts made them vulnerable to the cyberattack [55781]. 2. The same article states that Dunkin' staffers received customer complaints about hacked accounts in May 2015, indicating that the company was not proactive in addressing the security issues [55781].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) development_incompetence: - Article 25157 reports that Target Corp missed multiple opportunities to thwart the hackers responsible for the data breach, indicating a failure due to contributing factors introduced due to lack of professional competence by humans or the development organization. - Article 25158 mentions that Target Corp's security software detected potentially malicious activity during the data breach but the staff decided not to take immediate action, raising questions about the judgment and response of the development organization. (b) accidental: - Article 55781 discusses how hackers targeted Dunkin' Donuts and stole account credentials from the DD Perks loyalty program through credential stuffing, which is an accidental method where hackers use passwords from other breaches and spam them across websites.
Duration permanent, temporary (a) The software failure incident in the articles related to the Target data breach can be considered as a permanent failure. The breach occurred over a specific period, and the impact of the breach was significant, leading to the theft of millions of customer records and payment card information [23820, 59289, 25157, 55801, 25158, 55781]. The breach was not a one-time event but rather a continuous exploitation of vulnerabilities in Target's systems, resulting in the theft of sensitive data over an extended period. (b) The software failure incident can also be considered as a temporary failure in the sense that the breach was eventually identified, and actions were taken to mitigate the ongoing impact. Target responded by investigating the breach, removing malicious software, and implementing security measures to prevent future incidents [23820, 59289, 25157, 55801, 25158, 55781]. The breach was not a permanent state of failure but rather a situation that was eventually addressed and remediated.
Behaviour crash, omission, value, other (a) crash: - Article 55781 reports a crash incident where a speeding driver in Brooklyn was pulled over and found to have up to $20,000 worth of Apple products bought with gift cards purchased using stolen credit card data from Target customers [55781]. (b) omission: - Article 25157 mentions that Target missed multiple opportunities to thwart the hackers responsible for the data breach, including ignoring warnings that malware was being installed on Target's system and not responding to automated warnings about attackers planning escape routes for stolen data [25157]. (c) timing: - There is no specific information in the articles indicating a timing-related failure. (d) value: - Article 55781 describes a value-related failure where stolen credit card information from Target customers was being sold in online black markets for as little as $20 a batch [55781]. (e) byzantine: - There is no specific information in the articles indicating a byzantine-related failure. (f) other: - Article 25158 mentions that Target's security software detected potentially malicious activity during the data breach but the staff decided not to take immediate action, leading to a failure in decision-making and response to the security incident [25158].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident at Target resulted in a massive data breach where personal information and credit card data of millions of customers were compromised [23820, 59289, 55781]. The breach led to the theft of names, mailing addresses, phone numbers, email addresses, and debit and credit card data of customers who shopped at the retailer during specific dates [23820]. Additionally, the stolen credit card information was being sold in online black markets for as little as $20 a batch [55781]. Target faced potential class-action lawsuits and action from banks seeking reimbursement for losses due to fraud and the cost of card replacements [59289]. The breach also led to Target paying $18.5 million to 47 states and the District of Columbia as part of a settlement with state attorneys general [59289].
Domain information, finance (a) The failed system was related to the production and distribution of information as it involved a massive data breach at Target, where cybercriminals accessed customers' private information at point-of-sale terminals during check-out, resulting in the theft of names, mailing addresses, phone numbers, email addresses, and debit and credit card data of people who shopped at the retailer [23820]. (h) The failed system was also related to the finance industry as part of the aftermath of the data breach incident at Target, where the company agreed to pay $18.5 million to 47 states and the District of Columbia as part of a settlement with state attorneys general over the security breach that compromised the data of millions of customers [59289]. (m) The failed system was not directly related to any other industry mentioned in the options provided.

Sources

Back to List