In a scathing bit of reportage from Bloomberg Businessweek we discover that retailer Target had received word that its security system had been compromised nearly two weeks before it moved to act on the information. 
 
 In fact, last year Target hired FireEye, a security firm, to watch their servers for malware. The firm, which has a Bangalore-based response team, informed Target HQ in Minneapolis that someone had hacked the company on November 30. And no one did anything about it. 
 
 In short, according to Bloomberg, “for some reason, Minneapolis didn’t react to the sirens.” 
 
 The piece, as a whole, is delightfully detailed. It describes Target’s security system as well as FireEye’s “honeypot” servers that fooled attackers into thinking they had dropped into running servers but instead let them fool around in a sandboxed environment while FireEye watched. Then things got a little hairy. 
 
 The breach could have been stopped there without human intervention. The system has an option to automatically delete malware as it’s detected. But according to two people who audited FireEye’s performance after the breach, Target’s security team turned that function off. Edward Kiledjian, chief information security officer for Bombardier Aerospace, an aircraft maker that has used FireEye for more than a year, says that’s not unusual. “Typically, as a security team, you want to have that last decision point of ‘what do I do,’ ” he says. But, he warns, that puts pressure on a team to quickly find and neutralize the infected computers. 
 
 What this points to, in the end, is inaction on the part of Target and a clear effort by FireEye to shore up its reputation. If Target couldn’t be bothered to delete the malware, this piece suggests it’s not FireEye’s fault. While it never devolves into throwing anyone under the bus, it’s clear Target’s CIO Beth Jacob, who resigned last week, bore the brunt of the blame. 
 
 It just goes to show you that the best laid plans of mice and men gang aft agley. You can read Businessweek’s piece here. ||||| Target was prepared for its massive hack in November and knew of it early on, but did nothing to stop it, according to a report. 
 
 A Bloomberg Businessweek claims that, months prior to the attack, the retailer installed a $1.6 million malware detection tool from FireEye. Target also had a group of security specialists in Bangalore monitor the system at all hours. On Nov. 30, the Bangalore team got an alert and notified Target's security team in its Minneapolis headquarters. For some reason, however, that team did nothing about an attack that would eventually compromise up to 40 million customers' credit card data. (Target later revealed that personal information like email addresses and phone numbers had been compromised for 70 million customers, meaning a total of 110 million people may have been affected.) 
 
 See also: How to Check If Hackers Stole Your Data in Massive Target Breach 
 
 The report, which is based on a two-month investigation, contradicts Target's statements about the incident until now. In a Congressional testimony, the company claims that it only learned of the attack in mid-December, after the U.S. Department of Justice caught it and contacted Target. However, Businessweek cites computer logs that show there were FireEye alerts from Nov. 30 and then Dec. 2, when a second attack occurred. The article doesn't outline what specifically went wrong with Target's 300-person security team, except to characterize the inaction as a series of "blunders." FireEye has an option to automatically delete malware when it's detected, but Target's security team disabled that feature, according to the report. 
 
 Target's President and CEO Gregg Steinhafel issued a statement about the report, saying the company is in the midst of a company-wide probe to determine what happened. Target's CIO during the hack, Beth Jacob, resigned earlier this month. 
 
 Meanwhile, the report also speculates that the perpetrator of the hack may be Andrey Khodyrevskiy, a 22 year-old Ukrainian hacker who goes by the name Rescator. Khodyrevskiy in Odessa, which is described as a haven for "carders," a.k.a. dealers in stolen credit card info. However, Businessweek cautions that "there’s no definitive proof that Rescator and Khodyrevskiy are the same person." ||||| As the world watched highly skilled hackers take down power grids in Ukraine twice in two years, cybersecurity analysts reached the growing consensus that Russian hackers may be using the country as a testing ground for attacks they'll someday try on the United States. On Thursday, when news emerged that hackers have indeed been targeting American electric utilities—including a Kansas nuclear facility—it seemed possible that day had arrived. But it's worth noting there's a big difference between infecting a few energy companies' Windows machines with malware and grabbing the controls of a nuclear power plant. 
 
 The Hack 
 
 The FBI and the Department of Homeland Security have been scrambling to help multiple US energy firms and manufacturing plants fight off intrusions from hackers, according to reports Thursday evening from the New York Times and Bloomberg. Most worryingly, the targets of those attacks have included the Wolf Creek nuclear power plant near Burlington, Kansas, raising fears of an attack that could not only cause widespread electric outages but potentially disable nuclear safety systems. 
 
 But as disturbing as the words "hack" and "nuclear" appearing in the same sentence may be, it's important to step back. The severity of any industrial control system attack depends on whether hackers managed to breach not only its traditional computer systems, but also the far more obscure, less internet-connected systems that actually manipulate its physical equipment. So far it's not clear how many of the hackers' targets have been breached at all, not to mention any evidence that the attackers managed to access the targets' actual control system networks. 
 
 "These were business networks, not computer systems anywhere near the operational systems," says Robert M. Lee, the founder of the critical infrastructure cybersecurity firm Dragos, who says he had indirect knowledge of the incidents. "On the one hand it’s concerning. On the other it’s really far from anything near the industrial control systems." 
 
 Who's Affected? 
 
 The hackers have targeted at least a dozen distinct organizations, according to Bloomberg, from the Wolf Creek nuclear plant to an unnamed supplier of energy industry control systems. Security firm FireEye tells WIRED that the targets aren't limited to the US: Its researchers have seen spearphishing attempts from the same hackers against targets in Ireland and Turkey, stretching as far back as 2015, as well as "watering hole" attacks meant to infect victims with malware based on their routine visits to certain websites. Many of those attacks, according to FireEye researcher John Hultquist, have focused on electrical engineers and control system operators. "In our experience groups that have solely targeted energy like this have been carrying out reconnaissance for attack," Hultquist says.1 
 
 Who's Behind It? 
 
 Despite immediate suspicions that Russia may be laying the groundwork for Ukraine-style power grid attacks in the US, no digital fingerprints have yet tied the attacks to any specific group. 
 
 Those suspicions stem in part from recent history: Russia has likely tried to sow the seeds for power grid attacks in the US before. In 2014, the Department of Homeland Security warned that hackers had infected the networks of multiple US electric utilities with a piece of general purpose malware known as Black Energy. Cybersecurity firm FireEye tied those infections to a hacker group it called Sandworm, which it believed to be Russian based on clues like an openly accessible server tied to the group containing Russian-language documents. Sandworm would later go on to use Black Energy in intrusions against a variety of Ukrainian targets, including hacking three Ukrainian energy companies to cause the first-ever hacker-induced blackouts. 
 
 A year later, hackers attacked the Ukrainian energy firm Ukrenergo and took down about a fifth of the electric capacity of Kiev. Slovakian cybersecurity firm ESET and Lee’s company Dragos Inc. found that a piece of sophisticated malware from that attack known as “Crash Override” or “Industroyer” had been used to automatically trigger the blackout. Dragos also attributed the attack to Sandworm, raising new fears that Russia was testing a cyberweapon it might soon turn on American targets. 
 
 But US government agencies have yet to find any ties between the most recent attacks and Sandworm, according to Bloomberg and the Times. Security firm FireEye, despite years of tracking Sandworm, also couldn’t yet make any connections. 
 
 How Serious is This? 
 
 Any hacker probe of critical infrastructure systems is troubling. Attempts to breach a target with as much potential for catastrophe as a nuclear power plant are even more serious. And the attacks could be another sign that Russia or some other nation is developing the tools and the access to hold America’s most basic infrastructure in peril. 
 
 But the attacks are a long way from the ones actually used to turn out the lights in Ukraine, says Lee. The Times and Bloomberg reports go so far as to consider the possibility that heat-dispersing nuclear safety equipment could be disabled or that equipment could be permanently destroyed. But the threat of a nuclear disaster caused by the hackers shouldn't be overblown, Lee says. Based on years of security assessments of critical infrastructure utilities, he admits that the notion of an “air gap”—a separation between sensitive systems and internet-connected ones—is often illusory. In nuclear plants, by contrast, he says that disconnection is far stricter. “In nuclear environments, they have an air gap,” says Lee. That means that to jump from the corporate network, which these hackers reportedly probed, to the critical control systems would be far more difficult than in other industrial facilities. 
 
 None of that changes the fact that attacks on US power facilities represent a dangerous harbinger. But Lee argues the recent incidents are still too far from actual harm to infrastructure to warrant panic or overreaction. The hacker blackouts in Ukraine may show what's on the horizon for the US. But that future hasn't arrived just yet. 
 
 1Updated 7/7/2017 1:10pm EST with new information about the hackers' targets.
– If only Target had top-notch security software in place to prevent last year's disastrous hack. Oh wait, it did. In fact, a report by Businessweek/Bloomberg says the software was essentially screaming that something was amiss well in advance of any actual theft of customers' credit card data. Target had plenty of time to react—but did nothing. The $1.6 million software program from security firm FireEye detected the installation of malware on Nov. 30 and multiple times afterward, before hackers started stealing data, but the urgent alerts went unheeded. Why didn't the software kill the malware on its own? "The system has an option to automatically delete malware as it's detected. But according to two people who audited FireEye's performance after the breach, Target's security team turned that function off," says the story, which follows a two-month investigation. "It's possible that FireEye was still viewed with some skepticism by its minders at the time of the hack ..." The story points to "inaction on the part of Target and a clear effort by FireEye to shore up its reputation," writes blogger John Biggs at TechCrunch. "If Target couldn’t be bothered to delete the malware, this piece suggests it’s not FireEye’s fault." Click for the full story, which, as Mashable points out, speculates that the mastermind of the Target hack might be a 22-year-old Ukrainian.