Removed: nothing. The HVAC vendor’s network and the payment network sat in one reachable estate.
Outcome: 40 million credit cards stolen, after compromised HVAC vendor credentials gave the attackers their foothold.
The Target breach of 2013 started with compromised HVAC vendor credentials. The attackers moved laterally from the HVAC network to the payment system network because proper network segmentation wasn’t in place.
Source: ZDNet, Anatomy of the Target data breach: Missed opportunities and lessons learned (2 February 2015)