Target, a heating contractor and network segmentation

Around 12 November 2013, attackers logged in to the network of Target, one of the largest retailers in the United States. They did not break in through a store. According to a US Senate staff report, they used credentials stolen from Fazio Mechanical Services, a heating, ventilation and air-conditioning contractor that had remote access to Target's systems for billing and project management.

From that foothold they reached the point-of-sale terminals and installed malware that captured card data as customers paid. On 19 December Target confirmed that about 40 million card accounts had been exposed; in January it added that up to 70 million customer records, with names and email addresses, had also been taken. Target had been certified compliant with the card industry's PCI DSS standard in September 2013.