Home Depot Confirms Data Breach: What’s Next?

Published

May 9, 2018

Bob Sullivan is author of the New York Times best-sellers Gotcha Capitalism and Stop Getting Ripped Off. His stories have appeared in The New York Times, the Wall Street Journal, and hundreds of other publications. He has appeared as a consumer advocate and technology expert numerous times on NBC's TODAY show, NBC Nightly News, CNBC, NPR's Marketplace, Terry Gross' Fresh Air, and various other radio and TV outlets. He helped start MSNBC.com and wrote there for nearly 20 years, most of it penning the consumer advocacy column The Red Tape Chronicles. See more at www.bobsullivan.net. Follow Bob Sullivan on Facebook or Twitter.

Home Depot shoppers, check your credit card bills and bank statements. The home improvement giant confirmed Monday it was hit by hackers. While information is still scarce, it’s clear the hack will have a huge footprint. Here’s the relevant part of the firm’s statement:

“Last Tuesday, September 2, we disclosed that we were investigating a possible breach of our payment data systems. We want you to know that we have now confirmed that those systems have in fact been breached, which could potentially impact any customer that has used their payment card at our U.S. and Canadian stores, from April forward.

As security expert Brian Krebs, who first reported the leak, has said, this card heist has the potential to dwarf the now-infamous Target store hack. Home Depot has more stores, but more important, hackers had run of those stores for close to six months, compared to only three weeks for Target. Additionally, while Home Depot says no debit card PIN data was taken, according to Krebs, several financial institutions are seeing a spike in fraudulent ATM withdrawals.

In a statement emailed to me, Home Depot said the theft did not impact website shoppers at HomeDepot.com.

“We apologize for the frustration and anxiety this causes our customers, and I want to thank them for their patience and support as we work through this issue,” said Frank Blake, chairman and CEO says in the statement. “We owe it to our customers to alert them that we now have enough evidence to confirm that a breach has indeed occurred. It’s important to emphasize that no customers will be responsible for fraudulent charges to their accounts.”

Impacted customers are entitled to 12 months of identity repair service and credit monitoring, to be offered by AllClearID. There’s more information on the offer at https://homedepot.allclearid.com/.

The statement also said Home Depot stores plan to roll out chip-and-PIN enhanced credit cards by the end of this year.