Target data breach (2013): what happened and what to do
2 min read · Updated November 8, 2026
During the 2013 holiday season attackers stole data on about 40 million payment cards from Target stores, plus personal details of around 70 million customers. They got in through credentials stolen from a vendor. If you shopped there then, expect old data to resurface in phishing and check your email.
What happened
Target said attackers installed malware on its point-of-sale systems and captured card data from late November to mid-December 2013. The entry point was network access obtained with credentials belonging to a heating and cooling contractor.
Target announced the incident in December 2013 and expanded the scope in January 2014 to include customer contact details. It later agreed to a multistate settlement.
What was exposed
- ✓Card numbers, expiry dates and verification data for roughly 40 million payment cards.
- ✓Names, mailing addresses, phone numbers and email addresses for around 70 million customer records.
Were you caught up in a major breach?
Old breaches keep circulating for years. Scan your email against known breach records for a one-time $1.99.
Why it still matters
Cards from 2013 have long since expired, but contact details do not expire. Records like these are still used to make phishing look personal, for example a message claiming to be from a retailer you really did use.
The case is also a classic lesson in supply-chain risk: a small vendor’s weak access became the way into a large company.
What to do
- ✓Check your email address to see whether it appears in known breach records.
- ✓Change any password you used on the affected service, and anywhere you reused it.
- ✓Turn on two-factor authentication, starting with email and financial accounts.
- ✓Be careful with unexpected messages that mention the service.
Frequently asked questions
Do I need to worry about card fraud from 2013?+
Cards from that period have almost certainly been replaced or expired. The lasting risk is misuse of the contact details.
How did the attackers get in?+
Through credentials stolen from a third-party contractor, which they used to reach Target’s network before installing malware on payment systems.
Is my email part of this data?+
Check it. Contact details of about 70 million customers were involved, but not every dataset is searchable, so stay alert to retailer-themed phishing.
Stop guessing. Check your email in seconds.
The Leakill scan looks for your email address in known breach records and delivers a detailed report: the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-time $1.99 payment, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.