Free tools Windows power users keep installed
One-click scans. No signup required.
Target’s CEO confirmed on January 13, 2014, that malware had been installed on the company’s point-of-sale registers during its 2013 data breach. The attack exposed payment-card data from approximately 40 million credit and debit card accounts tied to U.S. store purchases between November 27 and December 15, 2013. Target later disclosed that personal information belonging to up to 70 million individuals was also taken.
Those figures describe separate, overlapping data sets—not 110 million distinct victims. The incident became a landmark example of how third-party credentials, weak network controls, POS malware and ineffective alert response can combine into a major retail breach.
As an Amazon Associate I earn from qualifying purchases.
What Target confirmed
Target initially announced on December 19, 2013, that attackers had gained unauthorized access to payment-card data from transactions at its U.S. stores. The company estimated that approximately 40 million credit and debit card accounts were affected.
In a CNBC interview reported on January 13, 2014, CEO Gregg Steinhafel confirmed that malware had been installed on Target’s point-of-sale registers. That established the central technical fact: malicious software had operated in the checkout environment and captured payment information while transactions were being processed.
#1 Best Overall
- HICO MAGNETIC STRIP: The stronger magnetic field makes our cards more durable. The data encoded on the stripes are less likely to be erased when exposed to an outside magnetic field.
- WORKS WITH ALL STANDARD PRINTERS: Our cards work well with all standard ID card printers, including DC150i and Fargo HDP5000 Zebra P330i. Not for use with inkjet printers.
- MULTI-PURPOSE: These cards can be used to store personal information for photo ID's, financial information for credit card use or retailers who want to sell gift cards for their business.
- SECURE & COMPATIBLE: These printable cards are equipped with high level security chips and stripes. The SLE4442 Chip is perfect for use for bank cards
- AVAILABLE IN BULK QUANTITIES: These cards are best purchased in bulk, especially for professional use. That's why we have made them available in 10, 100, 200 and 400 packs.
Target’s confirmation did not publicly identify every element of the attack. It did not, at that point, establish the attackers’ identity, provide a complete intrusion path or officially name a specific malware family. Later reporting and investigative analysis associated the incident with RAM-scraping malware and, in some accounts, the BlackPOS family. Those details should be attributed to researchers and later investigations rather than treated as facts Target itself confirmed in January 2014.
Target’s original announcement is available in its December 19 breach notice.
How point-of-sale malware captured card data
Point-of-sale malware is malicious software installed on systems involved in retail checkout and payment processing. It does not necessarily need to steal a database backup or find card numbers stored permanently on a disk.
- A customer swipes, inserts or otherwise presents a payment card.
- Payment software processes the transaction.
- Some card data is temporarily decrypted or available in usable form in the computer’s memory, commonly called RAM.
- Memory-parsing malware searches that temporary memory for payment-card tracks.
- The malware collects matching data and sends it to infrastructure controlled by the attackers.
Visa explained the underlying risk in a 2013 advisory: payment applications may decrypt authorization data in RAM during processing, creating an opportunity for memory-parsing malware. This is different from saying that Target intentionally stored all of the stolen data in plaintext on a permanent database. The relevant exposure occurred while transaction data was being handled by live checkout systems.
The Target breach timeline
| Date | What happened |
|---|---|
| November 12, 2013 | Later Target testimony indicated that attackers may have first entered the company’s network around this date. |
| November 27–December 15 | Target’s stated period for affected purchases at U.S. stores. |
| December 12 | Target said the Justice Department notified it of suspicious activity involving payment cards used at Target stores. |
| December 13 | Target met with the Justice Department and Secret Service. |
| December 14 | Target engaged an outside forensic investigation team. |
| December 15 | Target confirmed malware had been installed on its POS network and removed it from virtually all U.S. registers. |
| December 16–17 | Target notified payment processors and card networks. |
| December 18 | Malware was removed or disabled on additional disconnected registers. |
| December 19 | Target publicly confirmed the payment-card breach. |
| December 27 | Target said encrypted debit-card PIN data had also been removed, while stating that the PINs remained encrypted and the decryption key was not in Target’s environment. |
| January 10, 2014 | Target disclosed that personal information belonging to up to 70 million individuals had also been taken. |
| January 13, 2014 | Target’s CEO confirmed that malware had been used on the POS registers. |
The timeline is based on Target communications and congressional hearing materials, including the Senate hearing record.
How attackers reportedly entered Target’s network
Later public analysis identified credentials associated with Fazio Mechanical Services, a third-party HVAC contractor, as the likely initial access route. The Senate Commerce Committee’s analysis concluded that attackers apparently obtained vendor credentials, entered Target’s network and moved toward systems involved in payment processing.
Rank #2
- [SECURE INFORMATION STORAGE] Equipped with the advanced sle4442 security chip (256 bytes of protected memory), these smart cards offer write protection and logical encryption, ideal for safeguarding data
- [HIGH-COERCIVITY MAGNETIC STRIPE] These blank chip cards feature a durable 2-track HiCo magnetic stripe. Their stronger magnetic field resists data erasure from external magnetic exposure
- [COMPATIBLE WITH STANDARD PRINTERS] These blank credit cards with chip work with all major ID card printers like Evolis, Zebra, Fargo, and others. Not for use with inkjet printers
- [STANDARD CREDIT CARD SIZE] The sle4442 chip cards match the ISO CR80 standard: 85.6mm x 54mm, 30 mil thick—identical to a common credit card
- [VERSATILE APPLICATIONS] The sle4442 magnetic stripe card is perfect for access control, ID badges, membership cards, transportation, healthcare, and network security
This does not mean the HVAC company knowingly participated in the attack. The available public evidence supports describing the vendor as a compromised access path, not as the attacker. It also does not establish every detail of how the credentials were stolen.
Recommended Free Tools
The Senate analysis described the attack as a chain involving third-party access, movement through the network, installation of POS malware, collection of card data and exfiltration. It was an analysis of publicly available evidence rather than a complete forensic record, so conclusions about individual steps should remain attributed.
What information was exposed?
Payment-card data
Target said approximately 40 million credit and debit card accounts were affected. Its customer communications identified data including:
- Customer names
- Card numbers
- Expiration dates
- Card verification values, or CVV data
Target also said encrypted debit-card PIN data had been removed. It stated that the PINs remained protected by encryption and that the decryption key was not stored in Target’s systems. Therefore, “PIN data was removed” should not be rewritten as “PINs were exposed in plaintext.”
Other personal information
On January 10, 2014, Target disclosed that information belonging to up to 70 million individuals had also been taken. This category included names, mailing addresses, phone numbers and email addresses.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe 70-million figure was not a revised count of payment-card accounts, and it was not automatically an additional 70 million people. The two populations overlapped. Adding 40 million and 70 million produces a theoretical maximum only if the groups are treated as completely separate, which Target’s disclosures did not establish.
Rank #3
- Industry-Standard SLE4442 Smart Cards - Our blank credit cards feature genuine SLE4442 chip（256 bytes of protected memory), meeting ISO standards for reliable performance and universal compatibility in various security applications.
- Enhanced Security with 2 Track - These blank cards with chip include 2 high-coercivity (HiCo) magnetic stripes, offering superior data protection for access control systems and ID cards.
- Standard Credit Card Size- The SLE4442 chip card measures 85 mm x 54 mm and is 30 mil thick. This is the same size as an ISO CR80 standard credit card.
- Universal Printer Compatibility - Works seamlessly with all major ID card printers (including Fargo, Zebra, Evolis, Magicard, and more) for hassle-free encoding and personalization.
- Wide Range of Applications - Perfect for hotel key cards, employee IDs, membership programs, transportation tickets, prepaid systems.Durable PVC construction ensures long-lasting performance.
What was known at the time—and what came later?
Target-confirmed facts
- Unauthorized access affected payment-card data from U.S. store transactions.
- Approximately 40 million card accounts were involved.
- Malware had been installed on POS registers.
- Encrypted PIN data was removed, while Target said the PINs and decryption key remained protected.
- Personal information belonging to up to 70 million individuals was also taken.
- Target worked with the Secret Service and Justice Department and removed or disabled malware from affected systems.
Later investigative analysis
- Attackers reportedly used credentials associated with a third-party HVAC vendor.
- They apparently moved from less-sensitive systems toward the payment environment.
- Security alerts may not have prompted an effective response quickly enough.
- The incident was associated in technical reporting with RAM-scraping malware and, in some accounts, BlackPOS.
- Data was collected and exfiltrated through attacker-controlled infrastructure.
The distinction matters. “Target confirmed POS malware” is well supported. “Target confirmed BlackPOS, the full attack chain and every monitoring failure” is broader than the contemporaneous public confirmation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why the breach mattered technically
The incident was not simply a story about stolen credit-card numbers. It demonstrated several enduring security problems.
Third-party access can become a high-value entry point
A vendor does not need to process payment cards to present a security risk. If its credentials can reach a retailer’s internal environment, attackers may use that relationship as a stepping stone into more sensitive systems.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Network access is not the same as payment-system access—but segmentation must enforce the difference
Later congressional analysis pointed to movement from the vendor-access environment toward Target’s payment systems. Proper segmentation, restrictive firewall rules and tightly limited administrative privileges are intended to make that progression difficult.
Encryption does not eliminate exposure during processing
Encryption at rest can protect stored information, but payment applications still need to process transaction data. If sensitive data briefly appears in readable form in memory, malware running on the endpoint may attempt to capture it. That is why endpoint integrity, application controls and behavioral monitoring matter alongside encryption.
Alerts only help when people investigate them
The Senate staff analysis said Target appeared not to respond effectively to several automated warnings. That finding should be attributed to the congressional analysis, not presented as a court finding. The broader lesson is clear: a security alert that reaches an operations center but does not trigger escalation, containment or investigation is not an effective control.
Rank #4
- Use the, easy-to-use, and customizable POS to get started.
- Accept contactless payments, chip cards, Apple Pay, and Google Pay from anywhere, with improved connectivity, extended battery life, and enhanced security. Pay one low rate for every tap or dip.
- No long-term commitments or contracts, no monthly fees- and with offline payments, keep taking payments for up to 24 hours.
- Safely and securely accepts payments anywhere. Plus, get data security, 24/7 fraud prevention, and payment-dispute management at no extra cost.
- Use the, easy-to-use, and customizable POS to get started.
Compliance is not the same as continuous security
Target reportedly held payment-card industry compliance certification. That did not make compromise impossible. PCI DSS can establish important controls, but certification is not a guarantee against credential theft, malware, lateral movement or failures in detection and response. It is also too broad to say, without a specific supported finding, that PCI compliance itself caused the breach or was irrelevant to it.
Target’s post-breach security changes
Target later described a series of security and technology changes, including:
- More extensive monitoring, logging, security rules and alerts.
- Application whitelisting on POS systems and POS servers.
- Stronger network segmentation and firewall governance.
- Review and restriction of vendor access.
- Disabling selected FTP and Telnet access points.
- Password resets for approximately 445,000 team members and contractors.
- Expanded use of two-factor authentication and password vaults.
- Reduced privileges for selected accounts.
These measures addressed different parts of the attack chain: preventing unauthorized software, limiting movement, reducing credential abuse and improving visibility. Target’s account of the changes appears in its April 2014 security update.
What affected consumers were advised to do
Target advised customers to review bank and card statements, contact their card issuer about suspicious activity, report unauthorized charges and use fraud alerts or account notifications where available. Customers were also warned not to provide Social Security numbers or PINs to anyone claiming to represent Target.
Target offered free monitoring at the time and said customers would have zero liability for fraudulent charges arising from the breach. In practice, liability protections and reporting procedures can vary by payment network, account type, bank and jurisdiction. The safest response to an unexplained transaction is to contact the card issuer directly using the number on the card or an official statement.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The lasting lesson
Target’s January 2014 confirmation answered one important question: malware had been installed on checkout registers and used in the attack. The larger investigation showed why that fact mattered. A compromised third-party account, insufficiently restricted network access, malware operating in POS memory and ineffective alert response could combine to expose data from millions of transactions.
The enduring security lesson is layered defense. Retailers need strong vendor identity controls, least-privilege access, meaningful network segmentation, hardened POS endpoints, protection against memory-scraping techniques, continuous monitoring and a response process that treats suspicious alerts as potential incidents—not background noise.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
