Target — ~$202M PCI fine (2013)

HVAC vendor credentials → 40M payment cards + 70M customer records

What happened

Attackers used phished credentials from a third-party HVAC vendor (Fazio Mechanical) to pivot into Target's network and install RAM-scraping malware on POS systems, exfiltrating 40M card details + 70M customer records during the 2013 holiday season. Settlements + remediation exceeded $202M; the CEO and CIO resigned.

Root cause

• Third-party vendor with VPN access into payment-systems network zone
• No two-factor authentication on vendor portal
• POS endpoint protection did not detect RAM-scraper malware
• FireEye alerts were ignored or routed to a queue without an owner

What every team should do

1. Vendor network access must be JIT, scoped, MFA-enforced, and segmented from CDE
2. Build a Vendor Risk Management program (SOC 2 CC9.2 / FFIEC) with annual reviews
3. EDR alerts need a 24x7 SOC with named on-call rotation and resolution SLAs

Related enforcement actions