NPR : News

Filed Under:

U.S. HVAC Firm Reportedly Linked To Target's Data Security Breach

Hackers who broke into Target's computer network and stole customers' financial and personal data used credentials that were stolen from a heating and air conditioning subcontractor in Pennsylvania, according to digital security journalist Brian Krebs.

Target did not confirm Krebs' version of events when he presented his story to the giant retailer, citing the ongoing inquiry into how credit card data was stolen. Krebs cites anonymous sources and a confirmation of a visit from federal officials to the HVAC company:

"Sources close to the investigation said the attackers first broke into the retailer's network on Nov. 15, 2013 using network credentials stolen from Fazio Mechanical Services, a Sharpsburg, Penn.-based provider of refrigeration and HVAC systems.

"Fazio president Ross Fazio confirmed that the U.S. Secret Service visited his company's offices in connection with the Target investigation, but said he was not present when the visit occurred."

As for why an air conditioning company might need access to Target's computer network, a security expert tells Krebs that retailers sometimes grant such access to let vendors make changes and adjustments remotely, in order to cut heating and cooling costs.

In tweets following publication of his story today, Krebs said it's possible that Target's customer information was segmented away from other areas of its network, to prevent unauthorized access to sensitive financial data — but the hackers figured out a way to get to that data.

In recent months, Target and Neiman Marcus have headlined a list of companies reporting data breaches. The stories have led Congress to look at how to prevent such incursions, as Elise Hu reported for NPR's All Tech Considered earlier today.

Her story includes this quote from Sen. Al Franken, D-Minn.:

"Right now there's no federal law setting out clear security standards that merchants and data brokers need to meet, and there's no federal law requiring companies to tell their customers when their data has been stolen."

Copyright 2014 NPR. To see more, visit http://www.npr.org/.

NPR

Black Leadership In The Age Of Obama: A Look Back

PBS NewsHour co-anchor Gwen Ifill joins All Things Considered from the Democratic National Convention in Philadelphia, to discuss her 2009 book The Breakthrough. Ifill is re-examining the book's conclusions about black political leadership as President Obama prepares to leave office.
NPR

QUIZ: How Much Do You Know About Presidents And Food?

It's week two of the party conventions, and all these speeches are making us hungry. So we made a quiz to test your savvy about presidents and our favorite topic, food.
NPR

Protests Galore In The Streets Of Philly: Here's What They're All About

Thousands of protesters have descended on Philadelphia this week for demonstrations outside the Democratic National Convention. Here's a glimpse of the wide array of causes they're backing.
NPR

Police Use Fingertip Replicas To Unlock A Murder Victim's Phone

Michigan State University engineers tried 3-D-printed fingertips and special conductive replicas of the victim's fingerprints to crack the biometric lock on his Samsung Galaxy phone.

Leave a Comment

Help keep the conversation civil. Please refer to our Terms of Use and Code of Conduct before posting your comments.