Target confirms theft of 860 GB internal source code

What was taken

On January 13, 2026, multiple Target employees confirmed that internal source code and developer documentation had been stolen from the retailer. The leaked materials totaled approximately 860 GB and included several data repositories that were posted on Gitea, a self-hosted Git platform.

The repositories contained internal code, configuration files, and developer documentation. Repository names referenced internal systems including wallet services, identity management, store networking tools, secrets documentation, and gift card systems. Unlike typical data breaches that expose customer information, this incident focused entirely on Target's proprietary software infrastructure.

How it happened

Reports suggest that Target's Git server may have been accessible from the public internet before the breach, though the exact configuration remains unclear. Search engines had previously indexed and cached some content from git.target.com. An employee workstation infected with infostealer malware appears to have provided the initial access point, allowing attackers to obtain credentials and session tokens.

The compromised workstation had extensive access to internal systems including IAM, Confluence, Jira, and internal wikis. Target responded by taking its Git server offline and restricting access to the corporate VPN only. Internal memos indicated an accelerated change to access controls, but the data had already been exfiltrated.

Why source code matters

While this breach did not directly expose customer payment information or personal data, stolen source code creates different risks. Attackers now have detailed blueprints of how Target's internal systems operate, including technology stacks, programming languages, frameworks, and infrastructure dependencies. This information reveals exactly where to probe for vulnerabilities.

The incident highlights a gap many organizations overlook: development infrastructure often receives less security scrutiny than production systems. Misconfigured source code management tools, overly permissive CI/CD pipelines, and privileged access that persists for months without review all contributed to this breach. As one security analyst noted, the development environment has become the new attack surface, with identity as the primary control plane.