News

FIs see mounting ATM fraud following Home Depot data breach

The retailer says that no PIN data was stolen in the breach. However criminals have found other ways to solve the problem of missing PINs.

September 10, 2014

The Home Depot, the world's largest home improvement retailer, confirmed yesterday that its payment data systems have been breached in the U.S. and Canada (but not Mexico), a possibility that the company acknowledged last week in a news release.

However, this confirmation comes as old news for banks that are already seeing ATM fraud carried out by thieves using card data from stolen from Home Depot customers.

According to a news release from The Home Depot, "While the company continues to determine the full scope, scale and impact of the breach, there is no evidence that debit PIN numbers were compromised."

But the lack of PINs doesn't seem to be deterring thieves. According to the KrebsOnSecurity blog, an East Coast bank lost $25,000 in ATM fraud following the breach, while a bank on the West Coast told Krebs that, just days ago, it lost $300,000 within three hours as a result of the breach.

According to Krebs, the problem is the ease of changing the PIN number on a card to gain access to cardholder's account. The Home Depot breach netted fraudsters all the basic information they needed to successfully use the voice response systems at many banks to create new PINs.

As with other recent (massive) breaches, EMV transactions using encrypted data would have made it impossible for criminals to gather usable card information at the POS.

Also, as with other retailers that have recently fallen victim to this type of breach, The Home Depot is making haste to put EMV in place in its stores, as it explained in its press release:

Responding to the increasing threat of cyber-attacks on the retail industry, The Home Depot previously confirmed it will roll out EMV 'Chip and PIN' to all U.S. stores by the end of this year, well in advance of the October 2015 deadline established by the payments industry.