Target Data Breach (2013) — Failure of Forensic Readiness

Attackers stole 40 million credit/debit card records by breaching a third-party HVAC vendor's network credentials. Target's security team detected the intrusion early but failed to act decisively.

## Background

Attackers stole 40 million credit/debit card records by breaching a third-party HVAC vendor's network credentials. Target's security team detected the intrusion early but failed to act decisively.

## Learning Objective
Classify different types of cyber offenses and understand how proactive readiness impacts investigations.

## Scenario
You are the lead digital forensic investigator assigned to this case. Based on the real-world events described, you must analyze the available evidence, reconstruct the timeline, and produce a forensic report.

### Key Facts
- Case: Target Data Breach (2013) — Failure of Forensic Readiness
- Year: 2013
- Domain: Cyber Forensics
- Difficulty: Intermediate

## Evidence Available

Refer to the dataset at: https://github.com/arora200/aplly_case_db/tree/main/datasets/fss303-target-breach

## Investigation Questions

1. Identify the entry vector used in the Target breach.
2. Why did Target's security team fail to act despite detecting the intrusion?
3. What does 'forensic readiness' mean and how would it have changed the outcome?
4. Map the timeline from initial compromise to data exfiltration.
5. What logging and monitoring gaps existed in Target's infrastructure?

## Deliverables

1. Forensic Report — Document your findings, methodology, and conclusions
2. Timeline Reconstruction — Map the sequence of events
3. Evidence Log — Document all evidence collected with hash values
4. Legal Admissibility Checklist — Ensure your evidence meets evidentiary standards

## Expert Insight
If you don't log it, it didn't happen. Proactive forensics saves millions; reactive forensics just counts the damage.

## Forensic Takeaway
Being 'forensic-ready' means having logging enabled, time-synchronized servers, and a trained incident response team before the breach. Delayed investigation cost Target over $200M.