Home Depot Data Breach – Might be bigger than Target

Point of Sale Data Breach Alert

Yes, another one – and this time it may be bigger than any other U.S. point of sale breach before.

The Home Depot is currently investigating a potential point of sale data breach that may affect 99% of its U.S. based stores.

The corporation has yet to confirm anything, yet they have stated that they are “looking into some unusual activity” and have recommended “closely monitoring your accounts,” on their corporate website. Independent research has suggested, however, that The Home Depot data breach is big, and real, and that if you shopped at any of its U.S. locations from late April to September 2014 it’s time to get a new credit card.

Investigative Journalist Suggests 99% of Stores Are Affected

Brian Krebs is an investigative journalist who reports on information security. He was the guy who broke the news on the Target data breach in November 2013, before the corporation officially disclosed.

Krebs now writes that he has gathered data from an underground carding website – a place where stolen credit card numbers are bought and sold. His data suggests that 99% of U.S. based Home Depot retail outlets have experienced a data breach.

According to Krebs’ research, a fresh batch of more than 3,000 credit/debit card numbers was recently uploaded onto the carding site, rescator[dot]cc. Unlike usual batches, every single card number also featured a cardholder zip code – valuable information that makes it easier to commit fraud. After some analysis, Krebs found a 99.4%  overlap between the zip codes of the stolen cards and the zip codes of all U.S. based Home Depots.

Krebs’ list of potentially affected zip codes can be found here.

Needless to say, if your local store is on there and you’ve been doing some home improvement over the last few months, you should closely monitor your accounts for fraud.

Have a great (data-breach) free day!

For more insight into point of sale data breaches, see our recent alert on the Backoff malware and our Security Knowledge article, What’s with all the Point of Sale Data Breaches?

UPDATE 9/08/2014:

On September 7th, 2014, Krebs published a follow up to his initial report on The Home Depot data breach called, Home Depot Hit by Same Malware as Target. This article presents evidence that The Home Depot was infected by the BlackPOS malware, the same malware used in the Target data breach. As of September 8th, 2014, The Home Depot has yet to confirm a breach.

UPDATE 9/9/2014 – BREACH CONFIRMED:

The Home Depot has officially confirmed a data breach affecting all U.S. and Canadian stores from April 2014-August 2014. The official statement can be found here.