13 ms·
The Home Depot confirms payment systems breach
- mmastrac 12y agoI wonder if this will be less of an issue here in Canada with our euro-style chip & PIN setup. In theory the attackers wouldn't have long-lived access to any of the payment information. I suppose we'll see. The attackers probably have my name/email address/mailing information, which kind of sucks.
- WestCoastJustin 12y agoIt is not clear to me why they would have your name, email address, and mailing information? For example, I recently purchased some items from home depot and used my debit card + pin, other than rolling the pin, what else should we be doing? Do you have a home depot CC?
- simcop2387 12y agohome depot likes to collect email address for sending receipts (and spam). Along with that older style mag stripes will give out the name. Not sure about mailing info or how they'd get that. The thing to do is to actually get stores to stop storing CC info at all. they should be able to process the payment and then forget the info at all so it never has to be stored so it can't be stolen. EMV is actually a move to force this as they'll no longer be able to get the number, just verify a transaction in theory.
- zippergz 12y agoI've made a lot of Home Depot purchases in the last month (yay, new credit cards for me!), and I don't recall ever being asked for an email address either by a cashier or the self-check kiosk. Maybe it's just my local stores don't do it, though.
- heywire 12y agoJust for another point of data, all of my purchases during the timeframe in question were on the Self-Checkout units, and I was given the option for eReceipt, which I took advantage of. What I noticed was that upon returning with the same card, my email address was remembered, which tells me that they must store some information to cross reference (hopefully just name + last 4 or similar). Typing this reminds me that I actually did use both of my cards at Home Depot, because I now remember being prompted again when I had used another card. Guess that means two new cards for me...
- mmastrac 12y agoI don't have a Home Depot CC, but I've used their e-receipts in the last couple of months and I'm reasonably sure that I've ordered online from them in the past. I certainly hope they didn't compromise the PIN pads in the stores. That could be a Very Bad Thing.
- heywire 12y agoFrom what I've read so far, this was another case of memory scraping malware[1], most likely running on each POS. The pinpads typically have tamper protection, though I wouldn't completely discount the possibility that we'll see malware at the pinpad level at some point in the future. [1] http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-malware-as-target/ http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-ma...
- rickyc091 12y agoA lot of people make online purchases and pick up in store. When you make a return, you have to supply them a drivers license and that goes into the system as well. I'm wondering how much of this information was compromised. They use a third party company called Retail Equation for tracking returns. This company basically makes a profile / tracks your return patterns.
- jdong 12y agoChip&PIN is a red herring here, your data is just as compromised as it'd be with a magstripe card. EMV does not protect your card information.
- amckenna 12y agoIt doesn't protect the information but it does protect a user from the re-use of the information because the physical card is needed to perform an EMV transaction. Banks are switching to the EMV system because they can place the liability on the merchant if a fraudulent transaction is performed through them when they could have required an EMV transaction (thereby preventing the fraud).
- jdong 12y agoExcept that information can be used online...
- JimmaDaRustla 12y agoExcept they don't have the CVV, so, no...no it can't.
- ryanburk 12y agoencouraging that they are using this as a motivator to "roll out EMV "Chip and PIN" to all U.S. stores by the end of this year" ahead of the prescribed deadline. edit: "Chip and PIN" is taken directly from the sec filing that is linked. the described deadline of october 2015 for the liability shift comes from banks[1] and not a US law or similar. [1] http://en.wikipedia.org/wiki/EMV#United_States http://en.wikipedia.org/wiki/EMV#United_States
- dublinben 12y agoIs there actually a timetable for "chip and pin" in the US? I'm only aware of banks issuing chip + signature style EMV cards.
- mfrommil 12y agoPCI deadline for US retailers to implement chip + pin is October 2015. Mentioned in the Home Depot link above
- happyscrappy 12y agoMany don't read the article and just start commenting.
- jobu 12y agoIn all fairness, SEC filings are a rather incomprehensible format to read, even one this short.
- happyscrappy 12y ago"Responding to the increasing threat of cyber-attacks on the retail industry, The Home Depot previously confirmed it will roll out EMV "Chip and PIN" to all U.S. stores by the end of this year, well in advance of the October 2015 deadline established by the payments industry." Don't excuse laziness.
- tdfx 12y ago(1) Don't use debit cards. You're much better protected as a consumer when you use a credit card. http://www.bbb.org/blog/2013/11/do-debit-cards-and-credit-cards-hav-the-same-protection/ http://www.bbb.org/blog/2013/11/do-debit-cards-and-credit-ca... (2) Use BillGuard https://www.billguard.com/ https://www.billguard.com/ (3) Review your transactions every week or so via a personal finance tool (I use https://www.mint.com/ https://www.mint.com/) I don't particularly care if my payment credentials are compromised as it's highly unlikely a fraudulent charge would go unnoticed by me just using the advice above. It's quick, easy to set up, and stuff you really ought to be tracking anyway.
- serve_yay 12y agoAgreed on debit cards. Another way to vet charges is to use something that notifies your phone whenever you make a purchase. Simple bank does this, maybe others too.
- toomuchtodo 12y agoBump for Simple. Anytime an auth occurs, I get a push notification on my phone. Its so simple from a UX standpoint, not sure why other financial services firms (Discover, Amex, etc) don't push something like it out.
- MarkSweep 12y agoThe Amex app on iPhone sends push notifications for changes.
- heywire 12y agoChase also supports this via SMS, email, or push notification.
- toomuchtodo 12y agoThanks! I was unaware of this feature!
- 12y ago
- sjg007 12y agoSome home depots let you pay with paypal as well.
- pgrote 12y agoyep, I was thinking the same thing. While I've never used paypal at home depot, I wonder what the fallout from that would be. https://www.paypal.com/webapps/mpp/ent-instore-payments https://www.paypal.com/webapps/mpp/ent-instore-payments
- heywire 12y agoIt will be interesting to see if any Paypal account compromises can be attributed to this breach. From what I've read, this type of malware typically scrapes the memory of processes on the POS, looking specifically for what appears to be track data, and which passes a Luhn check.
- jdong 12y agoLove the EMV plug, as if it'd actually have helped. EMV transmits the card information in the clear, it only makes physical copying of the cards harder (Which really doesn't matter since credit cards can be used online). The only thing EMV would achieve is making this data slightly less valuable, but still worth it for the attacker. Replacing the EMV cards would also be more expensive by an order of magnitude. tl;dr: if you use your EMV card on a compromised POS, you'll be as fucked as you'd be with a magstripe card. Your bank will be ten times as fucked.
- kalleboo 12y ago> Which really doesn't matter since credit cards can be used online Don't you need the printed CVV for that? Which isn't stored on either the magstripe nor the chip. edit: 3DSecure would also help if banks cared to push it harder (for instance my bank now disallows all online debit card charges that don't use 3DSecure)
- jdong 12y agoNo, you really don't need the printed CVV for that. And several cards have actually had the CVV on the chip. Also, in many cases the chips actually contain enough information to replicate the magnetic stripe. (Which is well, bad.)
- heywire 12y agoEMV tag 57 [1] generally contains the "Track 2 Equivalent Data", and 5A the account number (PAN) [2] [1] http://www.emvlab.org/emvtags/show/t57/ http://www.emvlab.org/emvtags/show/t57/ [2] http://www.emvlab.org/emvtags/show/t5a/ http://www.emvlab.org/emvtags/show/t5a/
- JimmaDaRustla 12y agoThat's not the same CVV. Edit: Even having the track 2 data won't do you any good in reproducing an EMV card. The only way reproducing a mag stripe EMV card is useful, is if it is used at a non-EMV terminal and mag stripe is the only option. I believe Europe has complete banished mag stripe now.
- snarfy 12y ago> The Home Depot is offering free identity protection services, including credit monitoring, to any customer who used a payment card at a Home Depot store in 2014, from April on. This is absolutely not acceptable, and I deplore how this has become the status quo. I reject these services and want nothing less than a full lawsuit.
- jdong 12y agoA lawsuit which you would lose. Especially considering you most likely suffered no damages.
- snarfy 12y agoI'm pretty sure the card processors would be on my side of the lawsuit, along with a few million other home depot customers. I don't care about damages to me. I want the problem fixed. This Laissez-faire attitude towards online commerce security needs to end. Standards like PCI and PA-DSS are not enough. Corporations need to be liable for leaking everyone's information. A year of free credit monitoring is a slap in the face.
- jdong 12y agoCard processors might have a case, but the customers really mostly wouldn't. The PAN that belongs to your credit card company that was assigned to you by your credit card company was compromised and someone tried to defraud your credit card company using it. Yet it's you complaining, why?
- richardowright 12y agoIt seems to me like the breach may still be ongoing/the vulnerability may still exist. In the announcement, they use "have been" as in its actively occurring. Additionally, in the press release (http://ir.homedepot.com/phoenix.zhtml?c=63646&p=irol-newsArticle&ID=1964976&highlight= http://ir.homedepot.com/phoenix.zhtml?c=63646&p=irol-newsArt...), they don't indicate that the breach has stopped; they only say they have taken aggressive action. It seems unlikely that the attack would continue since the attackers have lost their cover, but the wording is a bit strange.
- heywire 12y agoI also found it strange how they worded things around the identity protection, "from April on", rather than something like, "From April XX, 2014 until September XX, 2014". Perhaps they just simplified the wording to make it clear that they're providing protection, and I'm reading too far into things :)
- offmycloud 12y agoOfficial SEC Edgar filing: https://www.sec.gov/Archives/edgar/data/354950/000035495014000034/hd_8-kx982014.htm https://www.sec.gov/Archives/edgar/data/354950/0000354950140...