Target said Wednesday that intruders accessed its systems by using credentials "stolen" from a vendor, one of the first details the retailer has revealed about how hackers got inside.
The vendor was not identified. A Target spokeswoman said she had no further details to share.
As the forensic investigation continues, the spokeswoman said Target has taken measures to secure its network, such as updating access controls and in some cases, limiting access to its platforms.
Up to 110 million payment cards and personal records were stolen between Nov. 27 and Dec. 15, when Target first confirmed it was the victim of a data breach. The company publicly announced the intrusion on Dec. 19.
Malicious software was installed on its point-of-sale terminals, which recorded payment card details, and 11GB of data was moved around Target's network before it was sent to remote servers.
Clues to the Target attackers' methods emerged in technical descriptions of the malware published by security companies, several of which later redacted or removed the information. The descriptions included an internal IP address, a Windows domain name, plus a login and password, which indicated the attackers had deep knowledge about Target's systems.
The Target malware is believed to be a modified version of "BlackPOS" or "Kaptoxa," which was first spotted by researchers around March 2013.
The malware's code contained a reference to "bladelogic," which is a server management tool made by software vendor BMC. BladeLogic is used for patching, configuring and updating servers.
Jim Walter, manager of McAfee's Threat Intelligence Service, wrote in a Jan. 21 blog post that the reference by the malware to BladeLogic was merely a ruse, as the malware wasn't designed to attack BMC products. Target hasn't described how its internal systems are architected and whether BMC systems may have been involved.
Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk