Case Study > Case #3: Cyber Breach at Target

downloaded from

Scholarfriends

https://scholarfriends.com

Downloaded by: writerforacademic@gmail.com | https://scholarfriends.com/singlePaper/273141/case-study-case-3-cyber-breach-at-target Distribution of this document is illegal.

Case #3: Cyber Breach at Target Danielle Furtado, Chris Leffingwell, Robert McCabe, Daniel A. Murphy, Nicholas Stamboulis, Arianna Thibodeau Professor Li MBA 523 June 12, 2019

Case Summary: In 1961, Target was founded by Douglas Dayton and created to combine the best of the fashion world with the best of the discount world; a quality store with quality merchandise and a discounted store all in one. His vision for Target was to provide consumers with an affordable yet high quality products while maintaining a fun experience. This vision lived up to its name for quite some time- in the third quarter 2013 Target has amassed revenues of over 72 billion, reflected a 2.8% compound annual growth rate over the previous five years, had 1,919 stores and around 80,000 SKU’s, but this picture perfect brand image came crashing down in September of that year.

Hackers from an unknown location initiated a phishing campaign within one of Target’s eternal heating ventilation providers, Fazio Mechanical Services. Information about Target’s vendors was publically available and hackers saw that Fazio was using a free malware detection

software that was actually a free version of a security protocol whose license explicitly said it wasn’t for enterprise use. The hackers saw this opportunity as a huge loophole to get into Fazio’s system. At this point in September, Target’s security team began identifying vulnerabilities in their payment card systems and cash registers, but they weren't brought to the attention of executives and dismissed accordingly.

On November 15, 2013 using Fazio’s credentials the hackers got into Target’s databases.

This could have been avoided using a two-step verification process, but it wasn’t in place at the time. The hackers began by first targeting Target’s POS systems and collected credit/debit card information. From here, due to the nature of Target’s network buildout, it allowed hackers to move throughout their internal networks and they were able to update the malware for another round of attacks. After two additional waves of attacks, it was predicted that the hackers stole over 11 gigabytes of customer data which is equivalent to around 40 million dect/credit cards accounts.

To make matters worse, Target’s contracted cybersecurity client, FireEye has aleterd Target that their monitoring protocol had detected malware intrusions, but the install to remove them had not yet been activated. The U.S. Target team decided to neglect the alert because they viewed it as a false positive, big mistake. FireEye even directly reached out to Target’s cybersecurity team in Minneapolis, but they didn’t even respond.

Fast forward about another month to December, the U.S. Department of Justice contacted Target about the breach, next, the media got hold of the story too. Target had to act fast and announced the terrible news on their website, but they weren’t prepared for what happened next.

By January 10th, after a full investigation was conducted, Target had to announce that in addition to payment card data, personal information including names and mailing and email

address had also been stolen for 70 million customers, 30 million more than previously thought.

At this point they had reached its lowest consumer perception since June of 2007.

The culmination of events above lead to Target’s total sales falling 6.6% for the fourth quarter of 2013 and when compared to the previous year, net earnings for the fourth quarter dropped by a jaw-dropping 46% to $520 million. Additionally, they faced extensive media scrutiny, investigations by Congress, the Securities and Exchange Commission, the DOJ and the Federal Trade Commission as well as litigation from affected customers, banks and shareholders.

If that’s not a wake up call, we’re not sure what is.

1.

What’s your diagnosis of the breach at Target- was Target particularly vulnerable or

simply unlucky?

Target was vulnerable, but they were also unlucky because not all vulnerable companies are subject to cyber attacks. In September 2013, Target's security team had identified vulnerabilities specifically in the payment card systems and cash registers. Also, in September 2013, the hackers initiated a phishing email campaign against Target's heating and ventilation vendor, Fazio Mechanical Services. Information about Target's vendors are publicly available online, so anyone, including hackers, can locate critical vendor information if they are motivated to search. In addition, Fazio, used a free security product called "Malwarebytes Anti-Malware," which is not licensed or intended for corporate use. Target is liable for not monitoring the vendor's security arrangements. If they had monitored their third party vendors, they would have discovered that Fazio's main method to detect malware was insufficient for corporate use, especially for a vendor of Target.

Target had two months to address the security warnings, and could have required twofactor authentication for third parties who have remote access to their network. The security investigation revealed that the hackers installed malware on Point -of-Sale, POS, systems. The hackers used RAM scraping to collect encrypted data and three variants of Citadel, the malware, to collect the credit and debit card information when the customers swiped their card. The hackers installed the malware on November 30th and twice more between December 2nd and 3rd. The poor network design allowed hackers to easily navigate the network, update the malware twice, gain access to the most sensitive customer data and export to a Russian based external server. Target's network was not properly segmented, the hackers were able to find the route from Fazio to the payment data.

Target's third party cybersecurity monitoring contractor, FireEye, alerted Target of intrusions on November 30th, Black Friday, and again on December 2nd. The US teams did not respond to the initial alert or the follow up on December 2nd. The hackers stored the stolen data, 11 Gigabytes altogether, on Target's network before transmitting through a series of fake servers before arriving to the hackers personal servers. Target did not discover the breach until December 15th. The hackers had access to the personal credit card information of Target's customers in real time almost two weeks.

Target was not only vulnerable, the security team was negligent. The security team turned off a function that would have automatically deleted the malware. The payment card industry, PCI, has a standard that requires two-way verification, but Target did not require their third party vendors to protect their network. Finally, Target should have taken every cyber threat seriously and investigated the potential false positives when FireEye alerted the in-house security team in Minnesota on November 30th.

2. What, if anything, might Target have done better to avoid being breached? What technical or organizational constraints might have prevented them from taking such actions?

In order to prevent the breach at Target, the company should have first and foremost paid closer attention to the security warnings that they initially ignored. Their security specialist FireEye had raised an initial warning about the breach of security. By the time the company responded it was too late and they had already been hacked. They also should have at the same time turned on the option to automatically delete malware, but their security team turned off this particular function. They also should have followed more closely to the standards set by Payment Industry Data Security because they had a certification yet the attack had still gone unnoticed for up to 18 days. What they also could have done better was ultimately create stronger firewalls and authentic password options so that hackers would have had a tougher time getting into their system. They would also have to notify their vendors to more closely monitor those particular files. This breach was largely the result of not paying attention to security measures or alerts to address any potential problems or concerns earlier. Technical constraints that could have prevented them from getting better firewalls is that if even if they did implement something safer they still might not have been able to prevent this breach from happening. However, a stronger system would have prevented the situation from getting much worse than it already did.

Organizationally the constraints were that they might not have had a full understanding of how serious the situation was because they had not been paid enough attention to security issues until after the breach occurred. They should have fully trained their employees in security measures so they could learn how to detect and protect the organization against potential issues like this

breach. There could also be a question of who would be responsible if such an attack occurred because the information security requirements were divided among three different positions: the Chief Financial Officer, the Chief Information Officer and the General Counsel.

3. What’s your assessment of Target’s post-breach response? What did Target do well?

What did they do poorly?

Having Target’s story posted by an online blogger before they could make an announcement about the breach, required them to make a public statement before they knew all of the facts about the situation. From this point forward, Target limited the amount of information they shared about the breach due to potential guidance from their lawyers and bank partners who often advise clients to share as little information as possible. According to a Forbes article on the breach, “they stayed silent when they should have broken the story themselves and over-communicated. They minimized when they should have maximized. They obfuscated when they should have leveled with their customers. And they made false assurances that they later needed to retract” (Temin, 2013). This caused distrust between Target and their customers and the loss of potential trust and loyalty to Target in the future. Limiting the information shared further upset customers and lead to customers having increased difficulties from the breach.

Although it was only a small gesture in comparison to the difficulties and struggles many customers faced, Target attempted to make up for their faults through giving customers a 10% discount. Giving their customers this discount may have worked to better the image of Target in the eyes of their customers. Also, even though it took the company until January 10, Target did a good job with decreasing the wait times for customer calls about the breach with their customer

service. When the breach was first announced, wait times were so long that some customers would hang up before they talked to any customer service representative because of the long wait. By January 10, Target improved by providing only an 8 second wait time for all of their customer calls to the company’s customer service.

4.

To what extent is Target’s board of directors accountable for the breach and its

consequences? As a member of the Target board, what would you do in the wake of the breach? What changes would you advocate?

After this intense data breach, fingers were being pointed every which way as to who is to blame for the incident. As deeply as this issue goes, the responsibility does fall mainly on the Board of Directors. The duties of each board member require them to “create and maintain a system to protect customers’ personal and financial information, as well as to inquire into and correct unsound practices” (Cyber Breach at Target, pg. 10). They are also required by their duties to inform customers of a breach immediately and accurately. This is the first reason that the blame can be pinned on the BOD. When the breach was first spotted, there was suspicion that the hackers had stolen customers’ credit/debit card numbers, PINs, CVVs, as well as personal information, such as address and Social Security numbers. In their first announcement of the breach, Target announced that the hackers did not get through the server that decoded the sensitive information, such as PIN numbers and Social Security numbers. However, about a week later, they announced that the hackers did have access to these sensitive numbers and by the time of the announcement, it was too late for customers to regain access to their accounts and money. They broke their duties by not fully informing the public of the scope of the breach, while also spreading the announcements out over a period of a few days, which only made the situation worse. However, it is not right to fully blame the BOD. The IT department who

ignored the multiple alerts of hackers and compromised systems should also be held responsible, as they are the ones who could have stopped the breach early on and avoided the situation as a whole.

If we were a member of the Target board, we agreed that we would have voted for a big announcement of what we did know and what any possibilities may have been at the time. We would not have waited to alert our customers of the fact that their PIN numbers were most likely stolen, as this could be viewed as suspicious and we could end up losing customers in the end.

In times of crisis and having your customers at risk, it is better to think about their well being and their perceptions on how you are handling things, rather than trying to save the company. If you cannot let it be known that you support and want to protect your customers, you will lose their business, which in turn puts you out of business.

Works Cited Srinivasam, Suraj, et al. “Cyber Breach at Target.” Harvard Business School, 10 Jan. 2019.

Temin, Davia. “Target's Worst PR Nightmare: 7 Lessons From Target's Well-Meant But Flawed Crisis Response.” Forbes, Forbes Magazine, 31 Dec. 2013, www.forbes.com/sites/daviatemin/2013/12/30/targets-worst-pr-nightmare-7-lessons-fromtargets-well-meant-but-flawed-crisis-response/#5dab648943cf.