Hackers got into Target through an air-conditioning vendor — and stole 40 million cards

In the 2013 holiday shopping season, the retailer Target suffered one of the largest data breaches in history. Attackers gained access not by breaking through Target's own defenses directly, but by stealing credentials from a third-party vendor that serviced Target's heating and air-conditioning systems. Through that vendor's access, the attackers moved into Target's network.

Once inside, the attackers installed malware on Target's point-of-sale systems and stole the credit and debit card numbers of about 40 million customers, along with personal information (names, addresses, emails) of about 70 million people. The breach went undetected for weeks, despite Target having security tools that had flagged the intrusion — alerts that were not acted on.

The fallout was severe. Target paid an $18.5 million multi-state settlement and a $10 million class-action settlement, spent hundreds of millions on remediation, and saw its sales and reputation damaged. Chief executive Gregg Steinhafel resigned in 2014. The breach became a landmark case in cybersecurity — a stark example of how a weak link in a supply chain, and ignored security alerts, can expose the data of tens of millions of customers.