Target Corp missed multiple opportunities to thwart the hackers responsible for the unprecedented holiday shopping season data breach, U.S. Senate staffers charged in a committee report released on Tuesday.
There was no indication the No. 3 U.S. retailer responded to warnings that malware was being installed on Target's system. Other automated warnings the company ignored revealed how the attackers would carry data out of Target's network, according to the report.
"This analysis suggests that Target missed a number of opportunities along the kill chain to stop the attackers and prevent the massive data breach," according to the Commerce, Science and Transportation Committee report.
The staff report, "A 'Kill Chain' Analysis of the 2013 Target Data Breach," looked at previously reported information and used an analytical tool called an "intrusion kill chain" framework used widely by information security field.
It was released on the eve of a committee hearing on how to protect personal consumer information from cyber attack. Witnesses will include John Mulligan, Target's executive vice president and chief financial officer, and Edith Ramirez, chairwoman of the Federal Trade Commission.
Target spokeswoman Molly Snyder declined committee on the staff report, saying the company did not want to discuss the breach before Wednesday's testimony by Mulligan.
The staff report said Target "failed to respond to multiple automated warnings from the company's anti-intrusion software" that 1) the attackers were installing malicious software and 2) they were planning escape routes for the information they planned to steal from the retailer's network.
It also said Target gave access to its network to a third-party vendor that did not follow accepted information security practices.
--- Reuters