The Target hack is usually told as the breach that came in through the air conditioning. It didn’t. This Breach Files episode walks the real chain: an HVAC vendor login that reached too far, a network that didn’t stop it, memory-scraping malware on the registers, and a detection that fired on November 30, 2013 and went nowhere.
We then run the case through the Threat & Control Method — Inventory, Threats, Controls, Scale — and close with three checks any IT pro can run this week.
The full written breakdown, with every source and a control-by-control table, is on the blog.
