The Home Depot homedepot.com Home Depot data breach: what happened and what to do
Between April and September 2014, malware on Home Depot's payment systems exposed about 56 million payment cards used at its US and Canadian stores. Home Depot confirmed it on September 18, 2014. Card numbers were the core of it, and email addresses were reported as exposed too.
View all 13,177 breaches- Breach date
- Apr 2014
- Made public
- 18 Sept 2014
- Data exposed
- Credit cards, Email addresses
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
On September 18, 2014, Home Depot confirmed that criminals had been inside its payment systems. The company said the breach ran from April to September 2014 and affected stores in the US and Canada. Stores in Mexico and online orders were not affected, according to the company.
The intruders used custom-built malware on the checkout network to capture card data as shoppers paid. Home Depot put the number at about 56 million payment cards. That counts cards, not people, so the number of affected customers is lower.
The company later said the intruders also took about 53 million email addresses. It agreed to pay up to $19.5 million to settle claims from affected consumers, and reporters at the time put its early costs at about $62 million.
Sources checked: pbs.org, spectrum.ieee.org, pcworld.com
Last verified against the official page:
What was exposed
Payment card data and email addresses. Stolen card numbers can be used for fraudulent purchases until the card is replaced. Stolen email addresses are most useful to scammers for phishing: a message that claims to be from Home Depot and asks you to confirm an order or a card looks believable when the sender knows you shop there.
Where this stands today
This breach is more than a decade old, and cards from 2014 have long since expired or been reissued. The email addresses are the part that can still matter, because they stay in circulation. If you shopped at Home Depot in 2014, treat unexpected messages about orders, refunds or settlements with suspicion.
What to do if you were in it
- 1
Check your card statements
If you paid by card at Home Depot in the US or Canada in 2014, look for charges you don't recognize and report them to your card issuer. The FTC advises contacting your bank or card issuer straight away if you see fraud.
- 2
Expect phishing that mentions Home Depot
Don't click links in unexpected emails or texts about orders, refunds or a settlement payment. Go to the company's site by typing the address yourself. The FTC's guidance on recognizing phishing is at consumer.ftc.gov.
- 3
Check whether your email is in this and other breaches
Run a free Serus scan to see which breaches your email address or phone number appear in. Serus monitors breach databases and the dark web and alerts you; it can't remove data from a breach.
- 4
Consider a credit freeze if you've had other breaches
Card numbers alone don't open new accounts, but if you've been in breaches that leaked a Social Security number, the FTC recommends a free credit freeze at Equifax, Experian and TransUnion.
Official filings
- California Attorney General , filed 10 Feb 2014
Timeline
-
Reported to the California Attorney General
-
The breach happened
-
The company made it public
Frequently asked
Was I affected by the Home Depot data breach?
If you paid with a card at a Home Depot store in the US or Canada between April and September 2014, you may have been. Home Depot said Mexico stores and online orders were not affected.
What was exposed in the Home Depot breach?
About 56 million payment cards and, according to later reports, about 53 million email addresses.
Is there a settlement?
Home Depot agreed to pay up to $19.5 million to settle consumer claims, according to PCWorld.
Should I change my password?
Passwords were not reported as part of this breach, so there is nothing to change for that reason. Use a unique password on every account regardless.
Sources
- pbs.org/newshour/nation/home-depot-say-56-million-credit-and-debit-cards-leaked-in-security-breach
- spectrum.ieee.org/home-depot-finally-admits-us-and-canadian-data-breach-compromised-56-million-payment-cards
- pcworld.com/article/419982/home-depot-will-pay-up-to-195-million-for-massive-2014-data-breach.html
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
