Home Depot Investigates Possible Breach

Retailer Working with Banks, Authorities on Probe

Home Depot Investigates Possible Breach

 

(This story has been updated.)

Home Depot has confirmed it is working with financial institutions and law enforcement to investigate a possible payment card breach.

"At this point, I can confirm that we're looking into some unusual activity and we are working with our banking partners and law enforcement to investigate," says Paula Drake, a spokesperson for the company.

"Protecting our customers' information is something we take extremely seriously, and we are aggressively gathering facts at this point while working to protect customers," Drake says. "If we confirm that a breach has occurred, we will make sure customers are notified immediately."

Drake says it would be inappropriate to speculate further about the incident for security reasons, but Home Depot will provide further information as soon as possible.

One executive with a leading card issuer on the West Coast says most banking institutions are just now reviewing logs for suspicious activity. News of a suspected breach at Home Depot only surfaced this morning, the executive says.

"As with the other recent breaches, we have not seen a lot of fraudulent activity," this executive adds.

Security blogger Brian Krebs first reported news of a possible breach at the home improvement retailer. He suggests that the same hackers who stole card data from Target and other retailers also attacked Home Depot. Krebs makes that connection because cards linked to previous Home Depot purchases have cropped up in the same underground forum, "rescator," where cards compromised at other retailers were sold.

But Andrew Komarov, CEO of cyber-intelligence firm Intelcrawler, says the industry should be wary of hurried conclusions about how this attack, if it's confirmed, might be linked to other recent breaches. The alleged card numbers that are apparently cropping up in underground forums may have been compromised in earlier attacks, rather than a new attack on Home Depot, he notes.

Home Depot has more than 2,200 stores in the United States, Canada and Mexico. So if a breach is confirmed to have affected a large number of its locations, the incident's scope could, potentially, be on a par with the Target Corp. breach, which compromised 40 million credit and debit card accounts as well as personal information for 70 million customers.

Executive Editor Tracy Kitten contributed to this story.