Blogger traces Target data breach to contractor's compromised emails

Thieves stole the network credentials from Target's heating and refrigeration contractor via an email phishing attack sent to the contractor's employees at least two months before they began hoovering up card data from cash registers, according to the blogger who first revealed the attack.

Data security reporter Brian Krebs wrote Wednesday at KrebsOnSecurity.com that Target's breach, in which payment card data or personal information of up to 110 million customers was stolen, was set up by a "malware-laced email phishing attack" on employees of Fazio Mechanical Services of Sharpsburg, Pa., Krebs said, citing "multiple sources close to the investigation."

Fazio was using a free version of Malwarebytes Anti-Malware as its main tool for detecting malicious software, Krebs said, adding that he considered that a flawed approach.

Krebs said that a former member of Target's security team, who was not identified, speculated that vendors' software would potentially give a vendor access to Target's server, and then potentially some form of access to the rest of Target's corporate network.

Blogger traces Target data breach to contractor's compromised emails 02/12/14 [Last modified: Wednesday, February 12, 2014 8:32pm]

© 2014 Tampa Bay Times

    

Join the discussion: Click to view comments, add yours

Loading...