Target Confirms Authenticity of Leaked Source Code Amid Security Changes

Multiple current and former Target employees have verified the authenticity of leaked source code and documentation shared by a threat actor on Gitea, a public software development platform. The leaked materials include internal system names such as ‘BigRED’ and ‘TAP [Provisioning],’ which correspond to real platforms used by Target for cloud and on-premise application deployment. The threat actor claims to possess a full dataset of approximately 860GB, although only a 14MB sample has been reviewed, containing authentic internal code and system references.

In response to the leak, Target announced an accelerated security change effective January 9, 2026, which restricts access to its Git server, git.target.com. This server, previously accessible over the web, now requires connections from a Target-managed network or VPN, indicating a significant lockdown of access to the company’s proprietary source code environment. The change aligns with how Target manages access to GitHub.com, where open-source code is typically hosted.

The root cause of how the data was leaked remains undetermined, but security researcher Alon Gal noted that a Target employee’s workstation was compromised by infostealer malware in late September 2025. This workstation had extensive access to internal services, raising concerns about potential insider involvement or a breach. While there is no direct confirmation linking this infection to the current leak, it highlights the risks associated with compromised employee workstations.

Implications for Cybersecurity

The confirmation of the leak and the subsequent security changes underscore the importance of robust cybersecurity measures for organizations. Companies must ensure that access to sensitive internal systems is tightly controlled and monitored, especially in light of the evolving threat landscape. The incident also serves as a reminder for employees to remain vigilant against phishing attacks and malware that could compromise their workstations.

Organizations should consider implementing multi-factor authentication (MFA) and regular security audits to mitigate risks associated with insider threats and compromised accounts. Additionally, monitoring for unusual access patterns and conducting employee training on security best practices can help prevent similar incidents in the future.

This event also highlights the potential consequences of data leaks, which can include reputational damage, financial loss, and regulatory scrutiny. Organizations must be prepared to respond quickly to such incidents and communicate transparently with stakeholders about the measures being taken to address the situation.