Home Depot confirmed yesterday that its POS systems were compromised by malware that may have begun collecting information on the chain's customers going back as far as April.
News of a possible breach first became public with a Krebs on Security article, which reported multiple banks had found evidence pointing to a breach at the home improvement retailer.
Home Depot confirmed its systems were breached at nearly 2,200 locations in the U.S. and Canada. It is working with the Secret Service, banks and security firms Symantec and Fishnet Security to address the situation.
At this point, Home Depot says it has not found evidence that any customer PIN numbers have been compromised. In a press release, it said it was taking aggressive steps to protect its customers' information. It has not, however, said its data has been totally secured. The chain is offering free identity protection services to any customers who used a credit or debit card from April 1 on.
"We apologize for the frustration and anxiety this causes our customers, and I want to thank them for their patience and support as we work through this issue," said Frank Blake, chairman and CEO, in a statement. "We owe it to our customers to alert them that we now have enough evidence to confirm that a breach has indeed occurred. It's important to emphasize that no customers will be responsible for fraudulent charges to their accounts."
While it has yet to be confirmed by Home Depot or law enforcement authorities, the Krebs report suggests a possible link between this breach and the one that compromised Target's system last year.
According to Krebs, Home Depot's breach could be larger than Target's in 2013. Over a three-week period, criminals gained information on roughly 40 million cards at Target. Home Depot's system appears to be compromised for a much longer period of time.
The same criminals behind the Target breach, believed to be from Russia and the Ukraine, appear to be responsible for the attack on Home Depot. According to Krebs, stolen cards from the group are being offered for sale as either "American Sanctions" or "European Sanctions" in an apparent payback for steps taken by Western nations for Russia's illegal annexation of Crimea and its support for separatists in Eastern Ukraine.