Home Depot Credit Card Breach! Bigger Than Target? [UPDATE]

[1492]

This according to KrebsOnSecurity.com who just today reported that banks and law enforcement are actively investigating a breach of customer credit card records, similar to the Target breach earlier this year. Though the number of U.S./Canadian stores involved may be significantly higher.



Source: KrebsOnSecurity.com



It also appears to be perpetrated by the same hacker group which is reportedly selling the hacked credit card data on the internet. Home Depot has not yet made an official statement as the investigation is ongoing.

See article for details Credit Card Breach at Home Depot.



★UPDATE!★ Home Depot Offering FREE Credit Protection/ID Theft Insurance

[1775]

What is interesting is that Home Depot has the capability to take the "chip" cards that will be mandated soon and are supposed to stop a lot of the security problems of credit card use in stores, but their system does not work. Put in a chip card and nothing happens and it has to be swiped. Even now after this breach they have not implemented the system that they already have the equipment for in their stores.

[PNW_Steve]

rockhillmanor wrote:
I know a couple of people who had their cards hacked at Target. It is truly a nightmare. And to this day no one will help them. Hard earned money stolen, Credit permanently ruined etc etc.

Years ago I had my account hacked ONCE when I used it to purchase something on the internet. Never again.:(

When I hit the road full time the first thing I did was open a checking account in a bank separate from where my retirement money is, to be used only for purchases with the debit/credit card that came with it.

I keep a very small amount of money in it. And add money when needed. I pay cash for most of my purchases. If they hack it they won't get much.

I have been on the road 7 years without ever using a real credit card. In fact I don't even own a credit card. And I adamantly refuse to own credit cards offered by stores. Don't care how much discounts they offer if you get one of their cards.

IMHO credit cards are no longer safe to use.

IMHO: cash is no longer safe to use. I have had cash stolen on several occasions in the past.

Seriously, in this day and age, you are taking a bigger risk paying for your meal in a restaurant with a credit card than you are using it to pay for a purchase from a reputable online store.

Google "credit card skimming".

[1492]

Confirmed! Home Depot issues a press release today confirming a data breach of customer credit info, which was first reported by KrebsOnSecurity.com a week earlier:

The Home Depot Provides Update on Breach Investigation

• Breach confirmed
  
  
• Investigation focused on April forward
  
  
• No evidence of debit PIN numbers compromised
  
  
• No customers liable for fraudulent charges
  
  
• Customers offered free ID protection, including credit monitoring services

ATLANTA, September 8, 2014 -- The Home Depot®, the world's largest home improvement retailer, today confirmed that its payment data systems have been breached, which could potentially impact customers using payment cards at its U.S. and Canadian stores. There is no evidence that the breach has impacted stores in Mexico or customers who shopped online at HomeDepot.com.

While the company continues to determine the full scope, scale and impact of the breach, there is no evidence that debit PIN numbers were compromised. Full press release.


Investigators are focusing on the possible use of a type of keylogger/data capture Malware known as BlackPOS. Apparently, a variate of Malware developed by a teenager in Russia, and sold on the underground market.

[Wrace]

hawkeye-08 wrote:
I recommend a credit monitoring service (I use Experian) and closely watching your statements. I have alerts on my Amex card that instantly texts me when a purchase is made without the card present (like when I make online purchases).

I should look into that with our Amex although it's only used for fuel anymore. Is there an extra charge for that feature?

[bwanshoom]

rk911 wrote:
sorry, but all of us, AMEX users and otherwise, ate those charges in the form of swipe fees charged to retailers who in turn pass them on to customers. there ain't no free lunch.

Very true. It is always ultimately passed down to the consumer.

[rk911]

wilanddij wrote:
...I don't know who ate the $500 in fraudulent charges, but it wasn't us; not even the usual $50 requirement. Great customer service from AMEX.

sorry, but all of us, AMEX users and otherwise, ate those charges in the form of swipe fees charged to retailers who in turn pass them on to customers. there ain't no free lunch.

[magicbus]

fj12ryder wrote:
I believe that Citi card still offers the single use numbers if you wish to use them.

So does Bank of America. Used it yesterday to give Ezpass an amount limited card good for 1 year.

Dave

[Old-Biscuit]

Freeze on credit agencies..Experian, Equifax & TransUnion.
Costs $10 per each agency.
No one can open any new account without notifying agency first.

Alerts on CC and Debt cards.

I can track usage within minutes of card being used....card/on-line/phone

Close an account....get new but it really ticks me off having to reset everything when a new account number is issued.

[TechWriter]

bwanshoom wrote:

Not sure what this means: "These crooks today are going in way deeper into your info than just the ability to use your card and charge some stuff at stores until you call it in stolen"

They're probably talking about identity theft.

For example, bad guys may not try charging stuff on your existing credit card. However, they may use your personal info (SSN#, address, phone #, etc) to try to open up a new credit card in your name.

Very bad mojo.

[1492]

Just checked the affected zip codes, and there is one Home Depot listed I've used my debit card on multiple occasions. But, the caveat is that there is also a Target across the street, so not clear if the zip code is actually for that particular Home Depot store?

It's going to be interesting to see if, and how Home Depot customer credit data was stolen. The Target breach was apparently not from skimmers as first thought, but through a keylogger trojan that was sent as an email attachment to one of their contractors. The hackers were able to steal the contractor's credentials to obtain elevated privileges on Target's servers. And they were apparently able to eventually access customer credit data.

[Bill_Satellite]

No unexpected charges. No concerns. Even if there were strange charges, no concerns. Are you amongst the group that does not keep receipts and does not look at your statement? If so, you deserve what you get. If you are not, you will never pay for anything you did not authorize.

[wilanddij]

Our result from the Target hack was that, while we were in CA, someone charged 4 fuel fillups on my wife's card in CO, OK, and TX on their was south. Got a notice from AMEX on the same day, had the charges reversed, and had new cards in our hands the next day. I don't know who ate the $500 in fraudulent charges, but it wasn't us; not even the usual $50 requirement. Great customer service from AMEX.

[fj12ryder]

I believe that Citi card still offers the single use numbers if you wish to use them.

[rk911]

pyoung47 wrote:
...Discover allows you to create single use numbers for online purchases.

no longer. they dropped that a few months back. a CSR told me it was more trouble to administer than it was worth.

[bwanshoom]

So it looks like Home Depot was hit nationwide, with 99.4% of Home Depot stores represented in the stolen card information. Krebs update