Confirmed! Home Depot issues a press release today confirming a data breach of customer credit info, which was first reported by KrebsOnSecurity.com a week earlier:
The Home Depot Provides Update on Breach Investigation
- Breach confirmed
- Investigation focused on April forward
- No evidence of debit PIN numbers compromised
- No customers liable for fraudulent charges
- Customers offered free ID protection, including credit monitoring services
ATLANTA, September 8, 2014 -- The Home Depot®, the world's largest home improvement retailer, today confirmed that its payment data systems have been breached, which could potentially impact customers using payment cards at its U.S. and Canadian stores. There is no evidence that the breach has impacted stores in Mexico or customers who shopped online at HomeDepot.com.
While the company continues to determine the full scope, scale and impact of the breach, there is no evidence that debit PIN numbers were compromised. Full press release.
Investigators are focusing on the possible use of a type of keylogger/data capture Malware known as
BlackPOS. Apparently, a variate of Malware developed by a teenager in Russia, and sold on the underground market.
