News

Home Depot releases new data breach details

In addition to payment card data, cyberthieves stole separate files containing approximately 53 million email addresses, the company has now disclosed.

November 7, 2014

Home improvement retailer The Home Depot has disclosed additional findings related to the recent breach of its payment data systems. According to a news release, the findings are the result of weeks of investigation by The Home Depot, law enforcement, and the company's third-party IT security experts.

The company has now announced that, in addition to card data, separate files containing approximately 53 million email addresses were taken during the breach. Home Depot said that the stolen files did not contain passwords, payment card information or other sensitive personal information.

Home Depot also described the modus operandi of the cyberthieves:

Criminals used a third-party vendor's user name and password to enter the perimeter of Home Depot's network. These stolen credentials alone did not provide direct access to the company's point-of-sale devices.

The hackers then acquired elevated rights that allowed them to navigate portions of Home Depot's network and to deploy unique, custom-built malware on its self-checkout systems in the U.S. and Canada.

As reported by the company on Sept. 18, the malware used in the attack had not been seen in any prior attacks and was designed to evade detection by antivirus software. Home Depot said at that time that the hackers' method of entry had been closed off and the malware eliminated from its systems.

The retailer is offering free identity protection services, including credit monitoring, to any customer who used a payment card at a Home Depot store from April 2014 on, the release said.

Additionally, Home Depot is rolling out EMV chip-and-PIN technology, which was deployed to Canadian stores in 2011. The project will be completed ahead of the payment industry's October 2015 deadline, the company said.