Almost two months after Target reported a massive data breach that put the personal data of up to 70 million shoppers at risk, more details have emerged about how the hackers gained access to the retailer's systems.
As first reported by security blogger Brian Krebs, hackers broke into Target's network using credentials stolen from a third-party vendor—Sharpsburg, Penn.-based Fazio Mechanical Services.
On Friday, owner and president Ross E. Fazio confirmed that his company, a refrigeration and HVAC systems maker, was "a victim of a sophisticated cyber attack operation."
"Our data connection with Target was exclusively for electronic billing, contract submission and project management, and Target is the only customer for whom we manage these processes on a remote basis," Fazio wrote in a statement. "No other customers have been affected by the breach."
Fazio denied conducting any remote monitoring or control of Target's heating, cooling, and refrigeration systems, and said that its "IT system and security measures are in full compliance with industry practices."
Fazio said he could not provide more details about what happened given that it is an ongoing investigation. "We are fully cooperating with the Secret Service and Target to identify the possible cause of the breach and to help create proactive initiatives that will further enhance the security of client/vendor connections making them less vulnerable to future breaches."
A Target spokeswoman declined to comment, citing the "active and ongoing investigation."
For more, see What To Expect After the Target Card Data Breach.