Home Depot POS breach

On 8 September 2014, The Home Depot confirmed it was investigating a breach of its payment systems. By 18 September the home-improvement retailer disclosed that about 56 million payment cards had been compromised across its U.S. and Canadian stores — the largest retail card breach of its time, surpassing the 2013 Target intrusion and the 2005 TJX breach.

What happened

The attackers gained their initial foothold using login credentials stolen from a third-party vendor. From that beachhead they moved into Home Depot's corporate network and ultimately onto the self-checkout point-of-sale (POS) systems, which were less directly supervised than staffed registers.

On those terminals the intruders installed custom point-of-sale malware — widely reported as a variant of the BlackPOS / FrameworkPOS family — designed to scrape unencrypted payment-card data from device memory at the moment a card was swiped. The malware operated from approximately April through September 2014, roughly five months, before it was detected.

What was exposed

• About 56 million unique payment cards (track data harvested at the POS).
• Around 53 million customer email addresses, disclosed later in 2014.

Because the malware captured card data in memory before encryption, even cards processed through ostensibly secure terminals were exposed.

Impact

The breach cost Home Depot an estimated $179 million in settlements and related expenses, including:

• A $134.5 million settlement with payment-card networks and issuing banks for fraud and card-reissuance costs, plus additional payments to credit unions.
• A consumer class-action settlement and identity-protection services.
• A $17.5 million multistate settlement in November 2020 with 46 U.S. states and the District of Columbia.

In response, Home Depot accelerated deployment of point-to-point encryption (using Voltage Security) across U.S. stores and adopted EMV chip-card terminals.

Why it matters

Home Depot, coming less than a year after the Target breach, hammered home two lessons for retail security. First, third-party vendor access is a primary attack path — the same vector that compromised Target — and must be tightly segmented and monitored. Second, POS systems that handle card data in unencrypted memory are inherently exposed; the incident accelerated the U.S. retail industry's shift to point-to-point encryption and EMV chip cards, which scramble card data end-to-end and render scraped magnetic-stripe data far less useful to fraudsters.