In a scathing bit of reportage from Bloomberg Businessweek we discover that retailer Target had received word that its security system had been compromised nearly two weeks before it moved to act on the information. 
 
 In fact, last year Target hired FireEye, a security firm, to watch their servers for malware. The firm, which has a Bangalore-based response team, informed Target HQ in Minneapolis that someone had hacked the company on November 30. And no one did anything about it. 
 
 In short, according to Bloomberg, “for some reason, Minneapolis didn’t react to the sirens.” 
 
 The piece, as a whole, is delightfully detailed. It describes Target’s security system as well as FireEye’s “honeypot” servers that fooled attackers into thinking they had dropped into running servers but instead let them fool around in a sandboxed environment while FireEye watched. Then things got a little hairy. 
 
 The breach could have been stopped there without human intervention. The system has an option to automatically delete malware as it’s detected. But according to two people who audited FireEye’s performance after the breach, Target’s security team turned that function off. Edward Kiledjian, chief information security officer for Bombardier Aerospace, an aircraft maker that has used FireEye for more than a year, says that’s not unusual. “Typically, as a security team, you want to have that last decision point of ‘what do I do,’ ” he says. But, he warns, that puts pressure on a team to quickly find and neutralize the infected computers. 
 
 What this points to, in the end, is inaction on the part of Target and a clear effort by FireEye to shore up its reputation. If Target couldn’t be bothered to delete the malware, this piece suggests it’s not FireEye’s fault. While it never devolves into throwing anyone under the bus, it’s clear Target’s CIO Beth Jacob, who resigned last week, bore the brunt of the blame. 
 
 It just goes to show you that the best laid plans of mice and men gang aft agley. You can read Businessweek’s piece here. ||||| Target was prepared for its massive hack in November and knew of it early on, but did nothing to stop it, according to a report. 
 
 A Bloomberg Businessweek claims that, months prior to the attack, the retailer installed a $1.6 million malware detection tool from FireEye. Target also had a group of security specialists in Bangalore monitor the system at all hours. On Nov. 30, the Bangalore team got an alert and notified Target's security team in its Minneapolis headquarters. For some reason, however, that team did nothing about an attack that would eventually compromise up to 40 million customers' credit card data. (Target later revealed that personal information like email addresses and phone numbers had been compromised for 70 million customers, meaning a total of 110 million people may have been affected.) 
 
 See also: How to Check If Hackers Stole Your Data in Massive Target Breach 
 
 The report, which is based on a two-month investigation, contradicts Target's statements about the incident until now. In a Congressional testimony, the company claims that it only learned of the attack in mid-December, after the U.S. Department of Justice caught it and contacted Target. However, Businessweek cites computer logs that show there were FireEye alerts from Nov. 30 and then Dec. 2, when a second attack occurred. The article doesn't outline what specifically went wrong with Target's 300-person security team, except to characterize the inaction as a series of "blunders." FireEye has an option to automatically delete malware when it's detected, but Target's security team disabled that feature, according to the report. 
 
 Target's President and CEO Gregg Steinhafel issued a statement about the report, saying the company is in the midst of a company-wide probe to determine what happened. Target's CIO during the hack, Beth Jacob, resigned earlier this month. 
 
 Meanwhile, the report also speculates that the perpetrator of the hack may be Andrey Khodyrevskiy, a 22 year-old Ukrainian hacker who goes by the name Rescator. Khodyrevskiy in Odessa, which is described as a haven for "carders," a.k.a. dealers in stolen credit card info. However, Businessweek cautions that "there’s no definitive proof that Rescator and Khodyrevskiy are the same person."
– If only Target had top-notch security software in place to prevent last year's disastrous hack. Oh wait, it did. In fact, a report by Businessweek/Bloomberg says the software was essentially screaming that something was amiss well in advance of any actual theft of customers' credit card data. Target had plenty of time to react—but did nothing. The $1.6 million software program from security firm FireEye detected the installation of malware on Nov. 30 and multiple times afterward, before hackers started stealing data, but the urgent alerts went unheeded. Why didn't the software kill the malware on its own? "The system has an option to automatically delete malware as it's detected. But according to two people who audited FireEye's performance after the breach, Target's security team turned that function off," says the story, which follows a two-month investigation. "It's possible that FireEye was still viewed with some skepticism by its minders at the time of the hack ..." The story points to "inaction on the part of Target and a clear effort by FireEye to shore up its reputation," writes blogger John Biggs at TechCrunch. "If Target couldn’t be bothered to delete the malware, this piece suggests it’s not FireEye’s fault." Click for the full story, which, as Mashable points out, speculates that the mastermind of the Target hack might be a 22-year-old Ukrainian.