Target Data Breach: Cybersecurity Failures and Human Error
This paper examines the 2013 Target data breach through the lens of two fundamental cybersecurity challenges: technological underinvestment and human error. The analysis focuses on how Target's sophisticated security infrastructure — including the FireEye intrusion detection system — successfully flagged the malware intrusion multiple times, yet organizational dysfunction and poor decision-making at every level of the company allowed the breach to continue for days. The paper argues that the attack succeeded primarily because of human and organizational failures rather than technological ones, and draws broader lessons about the role of management culture, chain-of-command accountability, and employee empowerment in corporate cybersecurity readiness.
- Fundamental Challenges in Cybersecurity: Technological underinvestment and human error as core vulnerabilities
- Target's Security Failures and Missed Warnings: FireEye flags ignored; automated defenses deliberately disabled
- Organizational Response and Decision-Making: Chain-of-command failures and delayed executive action
- Why the Attack Succeeded: Hackers exploited human factors, not technological weaknesses
- Conclusion: The Human Factor in Cybersecurity: Broader lessons for enterprise cybersecurity management
✍️ How to write this paper — guide, tools & examples ▾
What makes this paper effective
- Grounds the case analysis in a clear theoretical framework — the dual technological and human dimensions of cybersecurity — before applying it to the specific Target breach, giving the argument coherent structure.
- Uses concrete timeline details (November 30 and December 2 red flags, three-day delay after federal notification) to support evaluative claims, making the critique specific rather than generic.
- Maintains a consistent analytical voice that distinguishes between what is known from the case and what is inferred, signaling appropriate epistemic caution ("It is my sense that…", "The exact nature of the human error is not clear").
Key academic technique demonstrated
The paper models applied case analysis: it introduces an explanatory framework from the literature (Kraemer, Carayon & Clem, 2009; Winnefield et al., 2015), then systematically applies that framework to a real corporate incident. This approach — theory first, evidence second, evaluative judgment third — is a core technique in business and information-security case writing at the undergraduate level.
Structure breakdown
The paper opens with a two-part framework section covering technological and human cybersecurity vulnerabilities. It then moves into the Target case proper, addressing missed warnings and the automated-response decision in the second section. The third section evaluates organizational response — including chain-of-command failures and executive inaction. The fourth section analyzes why Target was targeted and why the attack succeeded, attributing causation primarily to human factors. A brief concluding section synthesizes the lessons for broader enterprise security practice.
Fundamental Challenges in Cybersecurity
With respect to cybersecurity, there are two fundamental challenges: technological and human. On the technology side, many firms underinvest in cybersecurity for various reasons. It can be difficult to keep up with evolving threats, such as new ransomware, and companies that lack modern cybersecurity technology are especially vulnerable. In particular, companies are often eager to adopt new technologies — today, cloud computing and the use of personal mobile devices for work purposes — without adequately investing in securing those new technologies. Many companies with in-house teams are ill-equipped, and many smaller companies are either unwilling or unable to invest in external security solutions (Security Magazine, 2016).
The other challenge is human in nature. Human beings are typically the weakest link in cybersecurity at the average organization. The weakness often manifests in the form of poor password hygiene (Majumdar, 2017), but it can also manifest in other ways. Winnefield et al. (2015) point out several additional human issues: failing to patch vulnerabilities in legacy systems, executives not making the right decision when hacking is detected, violations of standard procedures, and misconfiguring settings are all examples of human errors that can lead to cybersecurity breaches, even when the security stack is otherwise sufficient.
Target's Security Failures and Missed Warnings
The Target case highlights several errors the company made in handling its data breach. Target had set up a sophisticated security network that detected the breach almost immediately. The red flag that Target overlooked was literally a red flag: FireEye flagged the malware when it arrived in Target's system and began collecting data. That first red flag was raised on November 30th, and there was another on December 2nd when the malware was installed a second time. The case claims that as many as five such red flags were triggered. Any one of these should have prompted either an automatic or a manual response from Target's security team.
The first issue is that Target had turned off the automated system that could have deleted the malware upon detection. This was pure hubris on the part of the company's security team. As the case frames it: "Typically, as a security team, you want to have that last decision point of 'what do I do.'" The problem with that approach is that it forgoes an automated option and therefore places the full burden on the security team to respond — and that is precisely where the importance of human decision-making becomes critical.
The second issue is that human decision-making itself. The exact nature of the error is not entirely clear from the case, but there are a couple of possibilities. The first is that the security team simply chose to ignore the alarms, though there does not appear to be any meaningful basis for such a decision. The other possibility is that the security team did not have the authority to act directly on the alarms, and instead had to escalate up the chain of command — with inaction occurring at the higher levels. That would reflect a poor organizational structure. The company's CIO at the time resigned shortly after the incident, which lends some support to this interpretation (Biggs, 2014).
It appears that organizational structure issues contributed significantly to the non-response. It is reasonable to assume that there was a communication trail showing that security team members escalated the issue — probably all the way to the executive level. At that level, someone either did not understand the threat, failed to take it seriously, or was concerned about the company's reputation and hoped the problem would disappear on its own. Whatever the reason, the inaction was inexcusable, and most of the resulting damage could have been prevented.
Conclusion: The Human Factor in Cybersecurity
The Target case highlights the role that the human factor plays in cybersecurity breaches, and how hackers can exploit any company that has poor human factors in place. The attackers probably had no specific intelligence about Target's internal weaknesses; they were simply hunting for large enterprises, which offer the most lucrative returns from stolen credit card data. Today, many smaller businesses have become frequent targets precisely because they lack both the technological security infrastructure of large enterprises and the organizational processes to manage human risk.
Enterprises have learned important lessons from the Target experience, but vulnerabilities persist even among large companies. What this case makes clear is that technology alone is not sufficient — organizational culture, clear lines of authority, and empowered security personnel are equally critical components of an effective cybersecurity posture. Human error formed a large part of the problem for Target, and addressing that dimension must be a central priority for any organization serious about protecting its customers' data.
References
Biggs, J. (2014). Target knew about credit card hack for 12 days before reacting. TechCrunch. Retrieved November 19, 2017, from https://techcrunch.com/2014/03/13/target-knew-about-credit-card-hack-for-12-days-before-reacting/
Kraemer, S., Carayon, P., & Clem, J. (2009). Human and organizational factors in computer and information security: Pathways to vulnerabilities. Computers & Security, 2009, 1–9.
Majumdar, R. (2017). Poor password hygiene makes you a soft target for hackers. Smart Investor. Retrieved November 19, 2017, from http://smartinvestor.business-standard.com/pf/Pfnews-479754-Pfnewsdet-Poor_password_hygiene_makes_you_a_soft_target_for_hackers.htm
Security Magazine. (2016). Companies still lag in cybersecurity readiness. Security Magazine. Retrieved November 19, 2017, from https://www.securitymagazine.com/articles/87146-companies-still-lag-in-cybersecurity-readiness
Winnefield, J., Kirchhoff, C., & Upton, D. (2015). Cybersecurity's human factor: Lessons from the Pentagon. Harvard Business Review. Retrieved November 19, 2017, from https://hbr.org/2015/09/cybersecuritys-human-factor-lessons-from-the-pentagon
Create your account
Always verify citation format against your institution’s current style guide requirements.