Part 3 of Cyber Horror Stories, our series of true cyber disasters told campfire-style. A trusted vendor’s login gave attackers their way into Target in 2013, and the same weak point is being used again this month.
Target had given a refrigeration and HVAC contractor in Sharpsburg, Pennsylvania, a login for billing. In November 2013, attackers who had stolen that contractor’s credentials signed in as a trusted vendor and worked their way through the network to the registers, right through Thanksgiving and Black Friday.
Nobody broke in…someone was let in.
That is third-party vendor risk in one sentence: your security is only as good as the access you hand to everyone who works for you.
How Did the Target Breach Happen?
The attackers used a real contractor’s real password. A Senate committee analysis later found that Target failed to isolate its most sensitive systems and that its security team did not respond when software flagged the malware on November 30.
The 2017 settlement with 47 states put the damage at:
- More than 41 million payment card accounts
- Contact information for more than 60 million customers
- An $18.5 million payment, plus a requirement to separate cardholder data from the rest of the network and use two-factor authentication on certain accounts
In other words, the settlement ordered Target to put in the two safeguards that would have kept a contractor’s login away from the registers.
It’s Still Happening
Thirteen years later, third-party access is still the way in, and the vendors have just gotten bigger.
This Month: ConnectWise Cloud Backup
In mid-October, ConnectWise, a software company many IT providers rely on, found that attackers had gained unauthorized access to the app identities its Cloud Backup service uses to connect to Microsoft 365. Those work like a vendor login for software, and in one case reported by Huntress, an app granted itself Global Administrator, the highest level of access there is. ConnectWise suspended the service on October 17, and Microsoft has not confirmed that any customer data was taken.
In Florida: Jupiter Medical Center
In January, Jupiter Medical Center told patients that its records vendor, Cerner, had been breached, exposing names, Social Security numbers, diagnoses, and test results. The access dated back to January 2025; the hospital was not told until late November. Its own computers “were not impacted”, which was accurate and not much comfort to the patients.
If you are not sure which vendors and connected apps can sign in to your systems, that list is the first thing a free IT audit produces.
What Would Have Stopped It
Four controls stop most third-party vendor breaches:
- Fenced-off vendor access. A vendor login reaches only the one system the vendor needs, separate from payment systems.
- Only the permissions the job requires. Minimum access, no standing administrator roles, and anything unused gets removed.
- Multi-factor authentication on vendor logins. A stolen password alone is not enough.
- Alerts with an owner. A named person has the authority to act on every warning.
Who Else Has a Key?
Most businesses can name their vendors; far fewer can say which of them can sign in, to what, and from where.
Where GiaSpace Fits
Vendor access is rarely anyone’s full-time job, which is why it tends to go unreviewed until something goes wrong. We review who and what can sign in to a client’s systems, tighten the permissions, and set up the monitoring so an alert reaches a person who acts on it.
