a small supplier can't be a way into us

what everyone assumed

A large company works with many suppliers, and most of them are small: the firm that handles your refrigeration units, the one that submits invoices through a portal, the one with a narrow login for a narrow purpose. The reasonable belief is that a small vendor doing a small job is a small risk, because the access they hold is limited to the thing they were hired to do. It is reasonable because the vendor’s role is genuinely modest, and nobody pictures the path from a billing portal to the checkout lane.

what happened

The credentials belonging to the contractor, Fazio Mechanical Services, had been obtained by attackers. With them, the intruders reached Target’s network on November 15. From there the distance that mattered was not the vendor’s distance but the network’s: the access that started in a vendor-facing system was not walled off from the systems that mattered most. Over the following days the attackers moved toward the point-of-sale registers and uploaded card-stealing software to a small number of them, testing that it worked. By the end of November it was running on a majority of Target’s checkout devices, quietly collecting card data from live transactions as the holiday shopping season ran at full volume.

how it surfaced

Between November 27 and December 15, 2013, the malware captured roughly 40 million debit and credit card accounts, with personal information on tens of millions more customers exposed alongside them. The entry point, traced back by investigators and confirmed by the company, was the third party’s stolen credentials. The vendor was a refrigeration and HVAC subcontractor whose own connection to Target, it said, had nothing to do with payments at all.

A supplier’s size describes the supplier. It says nothing about the access.

What matters is where their login can reach once someone else is holding it, and a small vendor with a path into a flat network is a large vendor’s worth of risk.