The Home Depot confirms payment systems breach

http://ir.homedepot.com/phoenix.zhtml?c=63646&p=irol-SECText&TEXT=aHR0cDovL2FwaS50ZW5rd2l6YXJkLmNvbS9maWxpbmcueG1sP2lwYWdlPTk3OTYwNDImRFNFUT0wJlNFUT0wJlNRREVTQz1TRUNUSU9OX0VOVElSRSZzdWJzaWQ9NTc%3d

by manachar • 12 years ago

95 108 12 years ago

ir.homedepot.com

mmastrac2• 12 years ago

I wonder if this will be less of an issue here in Canada with our euro-style chip & PIN setup. In theory the attackers wouldn't have long-lived access to any of the payment information. I suppose we'll see.

The attackers probably have my name/email address/mailing information, which kind of sucks.

WestCoastJustin2• 12 years ago

It is not clear to me why they would have your name, email address, and mailing information? For example, I recently purchased some items from home depot and used my debit card + pin, other than rolling the pin, what else should we be doing?

Do you have a home depot CC?

simcop2387• 12 years ago

home depot likes to collect email address for sending receipts (and spam). Along with that older style mag stripes will give out the name. Not sure about mailing info or how they'd get that.

The thing to do is to actually get stores to stop storing CC info at all. they should be able to process the payment and then forget the info at all so it never has to be stored so it can't be stolen. EMV is actually a move to force this as they'll no longer be able to get the number, just verify a transaction in theory.

mmastrac2• 12 years ago

I don't have a Home Depot CC, but I've used their e-receipts in the last couple of months and I'm reasonably sure that I've ordered online from them in the past.

I certainly hope they didn't compromise the PIN pads in the stores. That could be a Very Bad Thing.

rickyc0912• 12 years ago

A lot of people make online purchases and pick up in store. When you make a return, you have to supply them a drivers license and that goes into the system as well. I'm wondering how much of this information was compromised. They use a third party company called Retail Equation for tracking returns. This company basically makes a profile / tracks your return patterns.

jdong10• 12 years ago

Chip&PIN is a red herring here, your data is just as compromised as it'd be with a magstripe card. EMV does not protect your card information.

amckenna3• 12 years ago

It doesn't protect the information but it does protect a user from the re-use of the information because the physical card is needed to perform an EMV transaction.

Banks are switching to the EMV system because they can place the liability on the merchant if a fraudulent transaction is performed through them when they could have required an EMV transaction (thereby preventing the fraud).

ryanburk2• 12 years ago

encouraging that they are using this as a motivator to "roll out EMV "Chip and PIN" to all U.S. stores by the end of this year" ahead of the prescribed deadline.

edit: "Chip and PIN" is taken directly from the sec filing that is linked.

the described deadline of october 2015 for the liability shift comes from banks[1] and not a US law or similar.

[1] http://en.wikipedia.org/wiki/EMV#United_States

dublinben• 12 years ago

Is there actually a timetable for "chip and pin" in the US? I'm only aware of banks issuing chip + signature style EMV cards.

mfrommil• 12 years ago

PCI deadline for US retailers to implement chip + pin is October 2015. Mentioned in the Home Depot link above

hellbanTHIS2• 12 years ago

I got into an argument about that with the guy at the Home Depot paint counter today. I blamed the hack on Home Depot probably running XP on their POS machines and he blamed the banks not doing something that they do in Europe, I'm assuming it's this EMV chip because it sounded like he was repeating something he was told.

ams6110• 12 years ago

Why on earth would you argue this issue with the guy at the paint counter? He clearly has nothing to do with either the cause or any remedy they might decide to offer.

ufmace• 12 years ago

Would it actually have helped, though? I was under the impression that the Chip and PIN POS terminals don't do anything differently as far as the part between themselves and the authorizer goes - if somebody hacks one, they can still get everything they need to charge against the card. If so, it's more of an issue of firewalling properly at the individual store and corporate level.

gergles• 12 years ago

Your impression is incorrect. Current EMV cards do something called DDA, so charging the card (as a card-present transaction) requires the card to be physically present or you to have cloned the application off the card (which the card is designed to prevent you from doing.)

You can still get the magstripe data if you compromise the terminal, but the network will (eventually) reject magstripe transactions made by a chip-capable card in a chip-capable reader. You can get the transaction certificate for one transaction, but that TC is protected from replay attacks.

tdfx• 12 years ago

(1) Don't use debit cards. You're much better protected as a consumer when you use a credit card. http://www.bbb.org/blog/2013/11/do-debit-cards-and-credit-ca...

(2) Use BillGuard https://www.billguard.com/

(3) Review your transactions every week or so via a personal finance tool (I use https://www.mint.com/)

I don't particularly care if my payment credentials are compromised as it's highly unlikely a fraudulent charge would go unnoticed by me just using the advice above. It's quick, easy to set up, and stuff you really ought to be tracking anyway.

serve_yay• 12 years ago

Agreed on debit cards. Another way to vet charges is to use something that notifies your phone whenever you make a purchase. Simple bank does this, maybe others too.

toomuchtodo2• 12 years ago

Bump for Simple. Anytime an auth occurs, I get a push notification on my phone. Its so simple from a UX standpoint, not sure why other financial services firms (Discover, Amex, etc) don't push something like it out.

WestCoastJustin2• 12 years ago

Or use cash and forget about all this other stuff ;)

snarfy4• 12 years ago

Oh the irony of how using cash is safer these days. You expose yourself to an internet full of thieves using plastic, but with cash it's only to the handful of people you actually cross paths with.

tericho• 12 years ago

Except I really like the free trips I get every year from accumulating travel reward points. Not to mention in my experience (personal and through acquaintances) Visa refunds fraudulent transactions immediately and with little to no hassle.

cpwright• 12 years ago

But don't forget about it in your pocket and then do the laundry ...

Losing or having a credit card compromised is pretty low on my list of real hassles.

rdtsc• 12 years ago

Unless your job pays you in cold hard cash, you have to go to the ATM. And you expose yourself to getting mugged, or have a the debit card skimmed. You could physically walk into the bank and get whatever-you-spend-per-month-in-stores in cash. So that might be an approach. But now you have to carry a fat wallet with you and manages lots of pocket change. Also not purchase much online.

superuser22• 12 years ago

Or understand that your card most likely has a zero fraud liability policy, meaning that if it gets stolen, the fraudulent charges simply go away.

If you use cash and it gets stolen, your money is just gone.

marveller2• 12 years ago

Billguard asks for my online bank username and password, it's a deal breaker for me. Do you really trust them? https://medium.com/@hyphenated/mint-com-and-billguard-are-ly...

berberous• 12 years ago

Billguard uses Yodlee as a backend, so at the very least I do trust that Billguard only has read-only access. I'm less certain how Yodlee functions -- whether they just scrape data and have full access, or whether they get some sort of read-only token from the financial institution.

iancarroll• 12 years ago

Stealing the key should be impossible, it should be on an HSM (which performs the cryptographic operations for you instead of giving you a key)

That's only one part of the article though.

girvo2• 12 years ago

And for those that can't get credit cards...? I mean, I agree with you that that's definitely the safest way, but lets not forget that there are a significant portion of the population that have bad or no credit and are stuck with Debit cards at best. What of them?

e1ven• 12 years ago

While I don't know as much about it as perhaps I should, the reloadable-prepaid market is very large. American Express offers a popular card in this model.

sjg007• 12 years ago

Some home depots let you pay with paypal as well.

pgrote• 12 years ago

yep, I was thinking the same thing. While I've never used paypal at home depot, I wonder what the fallout from that would be.

https://www.paypal.com/webapps/mpp/ent-instore-payments

heywire7• 12 years ago

It will be interesting to see if any Paypal account compromises can be attributed to this breach. From what I've read, this type of malware typically scrapes the memory of processes on the POS, looking specifically for what appears to be track data, and which passes a Luhn check.

jdong10• 12 years ago

Love the EMV plug, as if it'd actually have helped. EMV transmits the card information in the clear, it only makes physical copying of the cards harder (Which really doesn't matter since credit cards can be used online).

The only thing EMV would achieve is making this data slightly less valuable, but still worth it for the attacker. Replacing the EMV cards would also be more expensive by an order of magnitude.

tl;dr: if you use your EMV card on a compromised POS, you'll be as fucked as you'd be with a magstripe card. Your bank will be ten times as fucked.

kalleboo• 12 years ago

Which really doesn't matter since credit cards can be used online

Don't you need the printed CVV for that? Which isn't stored on either the magstripe nor the chip.

edit: 3DSecure would also help if banks cared to push it harder (for instance my bank now disallows all online debit card charges that don't use 3DSecure)

jdong10• 12 years ago

No, you really don't need the printed CVV for that. And several cards have actually had the CVV on the chip.

Also, in many cases the chips actually contain enough information to replicate the magnetic stripe. (Which is well, bad.)

JimmaDaRustla9• 12 years ago

Yes, you need the CVV printed on the back of the credit card to make an online purchase.

And the CVV on the back, is different than the CVV stored on the magstripe/chip.

amckenna3• 12 years ago

I think you are forgetting that EMV cards introduce the concept of digitally signing a transaction. That signature is then checked by the payment card processor and if it matches then the charge goes through. The signatures are performed by the chip on the card using a non-exportable certificate. This provides the "proof of presence" for the card and makes duplicating the EMV portion virtually impossible. This doesn't stop the other portions of the card from being stolen, but if merchants force EMV only transactions, stolen credentials cannot be used. It's a step in the right direction.

jdong10• 12 years ago

It's a step in the right direction, but the current implementations of EMV cards wouldn't have been of any help here.

JimmaDaRustla9• 12 years ago

EMV isn't about securing information, it's about customer/card validation - validating that the person using the card is who they say they are. Therefore you are secure from fraud - as you said, cards are hard to reproduce.

You still need the CVV code to use the card number in a card not present transaction. So not to your point, it is rather secure...

EMV would have helped immensely here, especially considering EMV compliant machines are held to PCI standards as well.

snarfy4• 12 years ago

The Home Depot is offering free identity protection services, including credit monitoring, to any customer who used a payment card at a Home Depot store in 2014, from April on.

This is absolutely not acceptable, and I deplore how this has become the status quo. I reject these services and want nothing less than a full lawsuit.

jdong10• 12 years ago

A lawsuit which you would lose. Especially considering you most likely suffered no damages.

snarfy4• 12 years ago

I'm pretty sure the card processors would be on my side of the lawsuit, along with a few million other home depot customers.

I don't care about damages to me. I want the problem fixed. This Laissez-faire attitude towards online commerce security needs to end. Standards like PCI and PA-DSS are not enough. Corporations need to be liable for leaking everyone's information. A year of free credit monitoring is a slap in the face.

davekeck• 12 years ago

No damages?

- Go through your entire credit history over a six month period looking for illegitimate charges. (Many people, such as myself, use a single credit card for most of their payments -- that's thousands of transactions.)

- Wait a week for a new credit card to arrive in the mail, and hope none of your automatic payments try to charge the old card while you wait for the new one.

- Update all of your automatic payments. Doing it once would be one thing, but every time one these breaches happens?

None of these are the end of the world, but they're certainly not "no damages".

pmorici• 12 years ago

I wonder if I can add this year of identity protection services on to the year I got from the Target breach not to long ago. At the rate these companies are losing my credit card number I'll have free identity theft protection services for life!

JimmaDaRustla9• 12 years ago

Typically the financial institute is responsible for any fraudulent charges on their customers' credit cards. The cardholders of the affected cards would probably have a hard time justifying that they were negatively affected by the breach.

richardowright• 12 years ago

It seems to me like the breach may still be ongoing/the vulnerability may still exist. In the announcement, they use "have been" as in its actively occurring. Additionally, in the press release (http://ir.homedepot.com/phoenix.zhtml?c=63646&p=irol-newsArt...), they don't indicate that the breach has stopped; they only say they have taken aggressive action.

It seems unlikely that the attack would continue since the attackers have lost their cover, but the wording is a bit strange.

heywire7• 12 years ago

I also found it strange how they worded things around the identity protection, "from April on", rather than something like, "From April XX, 2014 until September XX, 2014". Perhaps they just simplified the wording to make it clear that they're providing protection, and I'm reading too far into things :)

offmycloud• 12 years ago

Official SEC Edgar filing: https://www.sec.gov/Archives/edgar/data/354950/0000354950140...

The Home Depot confirms payment systems breach

Related Stories