Surprising Twist In Target's Data Breach Inquiry

In a recent article concerning the Target data breach, it was reported that the hackers used stolen credentials from one of Target's third party vendors to gain access to Target's systems.¹ New information just released indicates that the third party was not a technology service provider, but rather an HVAC company (heating, ventilation, and air conditioning).² While it may be surprising to the average consumer that an HVAC provider was given network access to Target's systems, there may be a reasonable explanations for this. 

While investigations are still underway, it is interesting to consider the possibility of whether the legal liability spotlight could shift from Target to the vendor and what, if anything, could have been done by Target to mitigate legal risk before the breach occurred.  Some strategies include the following: