Home Depot confirms suspected customer data breach
Home Depot
Home Depot revealed Monday that a security breach of customer data did occur at its stores, confirming suspicions raised last week.
Following an announcement last Tuesday it was investigating "unusual activity" related to customer payment cards, the Atlanta-based home-improvement retailer said any customer who used a credit or debit card in its US stores since April could be impacted by the breach.
"We want you to know that we have now confirmed that those systems have in fact been breached, which could potentially impact any customer that has used their payment card at our U.S. and Canadian stores, from April forward," the company said in a statement posted to its website. "We do not have any evidence that the breach has impacted stores in Mexico or customers who shopped online at HomeDepot.com."
The statement went on to say it apologized for the "frustration and anxiety" the security lapse has caused and said customers would not be responsible for fraudulent charges made on their accounts.
Home Depot did not indicate what kind of data was exposed or how many customers were affected. CNET has contacted Home Depot for comment and will update this report when we learn more.
The possibility of a breach was raised by security reporter Brian Krebs, who reported that "multiple banks" had seen evidence that Home Depot may be the source of a large cache of stolen customer credit and debit cards put up for sale on black markets. Krebs wrote that he suspected the breach may have begun in late April and extend to all 2,200 Home Depot stores in the US.
In an update late Sunday, Krebs wrote that he suspected that same malware that hacked the accounts of Target customers late last year may have compromised credit card information at Home Depot. One of Krebs' sources said that at least some of Home Depot's store registers were infected by a new variant of a malware strain known as "BlackPOS," the same type of malware found on point-of-sale systems at Target in last year's attack.
The hack of retail giant Target, in which hackers obtained credit card data and personal information for more than 110 million customers who shopped in its stores late last year, came at the beginning of an apparent uptick in security breaches at retail locations.
Over the past few months, arts and crafts retail chain Michaels Stores, department store Neiman Marcus, and restaurant chain P.F. Chang's revealed they were victims of security breaches aimed at stealing customers' credit card information.
Also from CNET:
