incident · 1396310400000

The Home Depot Data Breach

A massive data breach at The Home Depot exposed approximately 56 million payment cards due to custom-built malware installed on point-of-sale (POS) systems.

What happened

Cybercriminals used compromised vendor credentials to access The Home Depot's network. They deployed custom-built malware to POS systems in US and Canadian stores, which scraped payment card data from the magnetic stripe as cards were swiped between April and September 2014.

Technical mechanism

Attackers gained access via a third-party vendor's credentials, navigated the network, and deployed memory-scraping malware (a variant of BlackPOS) on POS terminals to capture track data in plain text before it was encrypted.

Why it matters

Following the 2013 Target breach, the Home Depot incident further underscored the systemic vulnerability of retail POS systems and accelerated the US transition to EMV (Chip and PIN) payment technology.

Impact

Approximately 56 million unique payment cards were compromised. The company incurred tens of millions of dollars in investigation, credit monitoring, and legal costs, and faced numerous class-action lawsuits.

Response

The Home Depot eliminated the malware, closed the entry method, and accelerated the rollout of enhanced encryption (format-preserving encryption) and EMV 'Chip and PIN' technology across its stores. They also offered free identity protection to customers.

Defensive lessons

  • Third-party vendor access must be strictly controlled, monitored, and subjected to multi-factor authentication.
  • Point-of-sale systems must utilize end-to-end encryption to protect payment data in memory.
  • Network segmentation is essential to prevent attackers from moving from corporate networks to payment environments.

Evidence register

  1. Securities and Exchange Commission (SEC) — Form 8-K: The Home Depot, Inc. (verified)