Tuesday, September 23, 2014
FAIRFIELD-SUISUN, CALIFORNIA
99 CENTS

Hackers may have used Pa. company to hit Target

By
February 08, 2014 |

NEW YORK — The hackers who stole millions of customers’ credit and debit card numbers from Target may have used a Pittsburgh-area heating and refrigeration business as the back door to get in.

If that was, in fact, how they pulled it off — and investigators appear to be looking at that theory — it illustrates just how vulnerable big corporations have become as they expand and connect their computer networks to other companies to increase convenience and productivity.

Fazio Mechanical Services Inc., a contractor that does business with Target, said in a statement Thursday that it was the victim of a “sophisticated cyberattack operation,” just as Target was. It said it is cooperating with the Secret Service and Target to figure out what happened.

The statement came days after Internet security bloggers identified the Sharpsburg, Pa., company as the third-party vendor through which hackers penetrated Target’s computer systems.

Target has said it believes hackers gained access to its vast computer network through one of its vendors. Once inside, the hackers installed malicious software in Target’s checkout system for its estimated 1,800 U.S. stores.

Experts believe the thieves gained access during the busy holiday season to about 40 million debit and credit card numbers and the personal information — including names, email addresses, phone numbers and home addresses — of as many as 70 million customers.

Cybersecurity analysts had speculated that Fazio may have remotely monitored heating, cooling and refrigeration systems for Target, which could have provided a possible entry point for the hackers. But Fazio denied that, saying it uses its electronic connection with Target to submit bills and contract proposals.

The new details illustrate what can go wrong with the far-flung computer networks that big companies increasingly rely on.

“Companies really have to look at the risks associated with that,” said Ken Stasiak, CEO of SecureState, a Cleveland firm that investigates data breaches. Stasiak added that industry regulations require companies to keep corporate operations such as contracts and billing separate from consumer financial information.

Stasiak emphasized that the thieves would have still needed to do some serious hacking to move through Target’s computer network and reach the checkout system.

Chester Wisniewski, senior security adviser for the computer security firm Sophos, said that while it may seem shocking that Target’s systems are that connected, it is a lot cheaper for a company to manage one network rather than several.

He added that while retailers are supposed to keep consumer information separate, they are not required to house it on a separate network.

Still, he said he was extremely surprised to hear that the hackers may have gotten in via a billing system, saying those kinds of connections are supposed to provide extremely limited access to the other company’s network.

As a result, while the hackers were clearly talented, it’s obvious something went wrong on Target’s end, he said.

“If normal practices were followed, they wouldn’t have been able to get access,” Wisniewski said.

Secret Service spokesman Brian Leary confirmed that investigators are looking into the attack at Fazio Mechanical Services, but wouldn’t provide details. Molly Snyder, spokeswoman for Minneapolis-based Target, would not comment.

Federal prosecutors in Pittsburgh referred calls to their counterparts in Minnesota, who would not discuss the investigation.

In the weeks since Target disclosed the breach, banks, credit unions and other card companies have canceled and reissued cards, closed accounts and refunded credit card holders for transactions made with the stolen data.

The Consumer Bankers Association said that its members have replaced over 17.2 million debit and credit cards as a result of the Target breach, at a cost of over $172 million.

Target has said its customers won’t be responsible for any losses.

Maureen Fissolo

LEAVE A COMMENT

Discussion | No comments

The Daily Republic does not necessarily condone the comments here, nor does it review every post. Read our full policy

.

US / World

California wildfire crews brace for weather shift

By The Associated Press | From Page: | Gallery

 
LA County sheriff’s deputies testing body cameras

By The Associated Press | From Page:

 
Bear suspected to have killed New Jersey hiker

By The Associated Press | From Page:

Poll: Support for gay marriage may be leveling off

By The Associated Press | From Page:

 
Islamic State militants kill 40 Iraqi troops

By The Associated Press | From Page:

Sierra Leone, Liberia brace for new Ebola cases

By The Associated Press | From Page:

 
Islamist group kidnaps Frenchman in Algeria

By The Associated Press | From Page: , 3 Comments | Gallery

Pennsylvania governor confident ambush suspect will be caught

By The Associated Press | From Page: | Gallery

 
Focus on UVa employee in student’s disappearance

By The Associated Press | From Page: | Gallery

 
Prosecutor: 800 rounds found in intruder case

By The Associated Press | From Page: , 2 Comments | Gallery

Islamic State offensive poses problems for Turkey

By The Associated Press | From Page:

 
Study links changing winds to warming in Pacific

By The Associated Press | From Page: | Gallery

Crews work to clear debris from Shasta mudslide

By The Associated Press | From Page: | Gallery

 
.

Opinion

Editorial cartoon for Sept. 23, 2014

By Daily Republic Syndicated Content | From Page:

 
Academia needs to act to protect college women

By Dan K. Thomasson | From Page:

 
.

Living

Today in History: Sept. 23, 2014

By The Associated Press | From Page:

 
Community Calendar: Sept. 23, 2014

By Susan Hiland | From Page:

 
Horoscopes: Sept. 23, 2014

By Holiday Mathis | From Page: B7

.

Entertainment

Kris Jenner files to divorce Bruce Jenner

By The Associated Press | From Page: | Gallery

 
Alaska TV reporter quits on air to promote pot

By The Associated Press | From Page:

Shonda Rhimes lays claim to Thursday nights on ABC

By Frazier Moore | From Page: | Gallery

 
Giuliani to help fight Noriega’s video game suit

By The Associated Press | From Page: | Gallery

‘The Lion King’ earns record box office

By The Associated Press | From Page:

 
Eric Lynch, Howard Stern’s diminutive foil, dies

By The Associated Press | From Page:

TVGrid Sept 23

By Daily Republic Syndicated Content | From Page: A11

 
.

Sports

Giants get closer, beat Dodgers 5-2 in 13 innings

By The Associated Press | From Page:

 
Prep boys water polo: Mustangs go 3-0 in Dixon tourney

By Daily Republic staff | From Page:

 
Prep boys soccer: Mustangs hold Indians to 0-0 draw

By Daily Republic staff | From Page:

 
MNF: Bears hold on to beat Jets 27-19

By The Associated Press | From Page:

Jeff Samardzija pitches A’s past Angels 8-4

By The Associated Press | From Page:

 
Nebraska’s Abdullah: Jameis Winston must grow up

By The Associated Press | From Page:

Raiders have to settle for moral victory

By The Associated Press | From Page:

 
Home of 49ers lineman Ray McDonald burglarized

By The Associated Press | From Page: , 1 Comment

Undisciplined play sends 49ers to 1-2 start

By The Associated Press | From Page:

 
Kicking game: It is called football, after all

By Barry Wilner | From Page:

US Soccer stands by Solo decision

By The Associated Press | From Page:

 
FIFA ethics judge hesitates on World Cup

By The Associated Press | From Page:

 
Braves fire GM Frank Wren after missing playoffs

By The Associated Press | From Page:

Royals beat Indians 2-0, gain on Tigers

By The Associated Press | From Page:

 
Bettman says NHL proactive about off-ice conduct

By The Associated Press | From Page:

Silver: NBA will review domestic violence policies

By The Associated Press | From Page:

 
Concern over McIlroy, McDowell more about results

By The Associated Press | From Page:

NFL vetting process: There are no sure things

By The Associated Press | From Page:

 
Owner: ‘No misinformation’ by Ravens on Rice

By The Associated Press | From Page:

This date in sports history for Tuesday, Sept. 23, 2014

By The Associated Press | From Page:

 
Kent creates scholarship for Cal women’s athletics

By The Associated Press | From Page:

 
.

Business

Treasury to unveil steps to curb tax inversions

By The Associated Press | From Page:

 
Tesco suspends execs over inflated profit report

By The Associated Press | From Page:

GM expert says 21 deaths eligible for compensation

By The Associated Press | From Page: | Gallery

 
Apple: 10 million iPhone 6 and 6 Plus sold

By The Associated Press | From Page: , 1 Comment

US existing home sales fall in August

By The Associated Press | From Page:

 
Investors fret Yahoo’s future, stock dips

By The Associated Press | From Page: | Gallery

Businesses and investors pressing for green policy

By The Associated Press | From Page: | Gallery

 
.

Obituaries

.

Comics

Garfield Sept 23

By Daily Republic Syndicated Content | From Page: B6

 
Baldo Sept 23

By Daily Republic Syndicated Content | From Page: B6

Dilbert Sept 23

By Daily Republic Syndicated Content | From Page: B6

 
Baby Blues Sept 23

By Daily Republic Syndicated Content | From Page: B6

Cryptoquote Sept 23

By Daily Republic Syndicated Content | From Page: B7

 
Beetle Bailey Sept 23

By Daily Republic Syndicated Content | From Page: B6

Zits Sept 23

By Daily Republic Syndicated Content | From Page: B6

 
Bridge Sept 23

By Daily Republic Syndicated Content | From Page: B7

Crossword Sept 23

By Daily Republic Syndicated Content | From Page: B7

 
Word Sleuth Sept 23

By Daily Republic Syndicated Content | From Page: B7

Frank and Ernest Sept 23

By Daily Republic Syndicated Content | From Page: B6

 
Pickles Sept 23

By Daily Republic Syndicated Content | From Page: B6

For Better or Worse Sept 23

By Daily Republic Syndicated Content | From Page: B6

 
Rose is Rose Sept 23

By Daily Republic Syndicated Content | From Page: B6

Sally Forth Sept 23

By Daily Republic Syndicated Content | From Page: B6

 
Get Fuzzy Sept 23

By Daily Republic Syndicated Content | From Page: B6

Sudoku Sept 23

By Daily Republic Syndicated Content | From Page: B7

 
B.C. Sept 23

By Daily Republic Syndicated Content | From Page: B6

Wizard of Id Sept 23

By Daily Republic Syndicated Content | From Page: B6

 
Blondie Sept 23

By Daily Republic Syndicated Content | From Page: B6

Peanuts Sept 23

By Daily Republic Syndicated Content | From Page: B6