Archive for Home Depot

Canadians Can Now Freak Out About Home Depot Hack

Posted in Commentary with tags , on September 9, 2014 by itnerd

Earlier today, I posted a story about the confirmation of the hack of Home Depot and the theft of 60 million credit card numbers. I also mentioned that Canadians MAY not have anything to worry about but they should check their credit card statements closely.

I’m here to say they now can officially start worrying. Here’s what the Toronto Star has to say:

Security researcher Brian Krebs, who first reported the attack last week, said on Tuesday that the stolen data, which can be used to make fake cards, is available for sale online. Cards issued by all of the big five Canadian banks — RBC, TD, CIBC, BMO and Scotiabank — are listed on at least one website selling hacked credit card information.

Well, that’s just craptastic. Clearly this isn’t going to end well for anyone involved. Here’s what’s worse:

An RBC spokesperson on Tuesday would not confirm whether any of its customers were affected. “We are aware of the breach and have taken the necessary precautions to identify and minimize any potential impacts on our clients,” RBC spokesperson Andrew Block said.

Customers will not have to pay for any potential fraudulent transactions, he said. The bank is recommending that customers monitor their accounts closely for signs of unauthorized use.

TD said on Tuesday that they would not comment on the attack or whether any client cards were affected.

CIBC, Scotiabank and BMO did not respond to requests for comment on Tuesday.

None of that inspires any confidence. I would have hoped that the five banks involved would have said something more substantial. Hopefully, they will have the backs of Canadians on this.

 

Leave a comment »

Home Depot Confirms Massive Hack Involving Credit Card Data

Posted in Commentary with tags , on September 9, 2014 by itnerd

If you’ve shopped at Home Depot over the last few months, you should likely check your credit card statements closely. Because the company has confirmed what was rumored for a week. A massive hack has taken place and the number of people affected could be staggering according to the New York Times:

The retailer said the exact number of customers affected was still not clear. But a person briefed on the investigation said the total number of credit card numbers stolen at Home Depot could top 60 million. By comparison, the breach last year at Target, the largest known attack to date, affected 40 million cardholders.

Well, that’s huge. Up until now, it wasn’t clear if this was a US only problem or if it affected stores in Canada, but it has become clear that it affects both countries:

The breach may have affected any customer at Home Depot stores in the United States and Canada from April to early last week, said Paula Drake, a company spokeswoman. Customers at Home Depot’s Mexico stores were not affected, nor were online shoppers at HomeDepot.com. Personal identification numbers for debit cards were not taken, she said.

The fact that personal identification numbers were not taken (as far as they know), is potentially good. That’s because in Canada, chip and PIN based credit and debit cards are almost universal in this country. That in theory makes them more secure than credit card and debit card users who rely on magnetic stripes based systems such as those in the USA. Thus, Canadians MAY not have to worry as much about this. Still they should check their credit card statements closely.

What this underscores is the fact that companies of all sizes really need to better secure data and protect themselves from threats. Plus there should be penalties, and pretty strict ones if a company fails to do so. I know I keep saying this every time something like this happens, but it’s clearly needed.

Leave a comment »

Home Depot Hit By Same Malware That Hit Target

Posted in Commentary with tags , on September 8, 2014 by itnerd

This isn’t good.

The Home Depot hack of credit card info is pretty bad given the scale. But what’s making it worse is that according to Brian Krebs, the same person who discovered the hack, it looks like the malware has been used previously:

A source close to the investigation told this author that an analysis revealed at least some of Home Depot’s store registers had been infected with a new variant of “BlackPOS” (a.k.a. “Kaptoxa”), a malware strain designed to siphon data from cards when they are swiped at infected point-of-sale systems running Microsoft Windows.

The information on the malware adds another indicator that those responsible for the as-yet unconfirmed breach at Home Depot also were involved in the December 2013 attack on Target that exposed 40 million customer debit and credit card accounts. BlackPOS also was found on point-of-sale systems at Target last year. What’s more, cards apparently stolen from Home Depot shoppers first turned up for sale on Rescator[dot]cc, the same underground cybercrime shop that sold millions of cards stolen in the Target attack.

Great. The bad news doesn’t end there:. There seems to be proof that the hacker or hackers behind this have an anti-American bent to them. That’s really troubling and this should make those at the highest levels of the US government worry.

I wonder how much worse this can get?

 

 

Leave a comment »

BREAKING: Home Depot May Have Been Hacked And Credit Card Data Might Have Been Swiped

Posted in Commentary with tags , , on September 2, 2014 by itnerd

Brian Krebs who hit the big time last year by uncovering the now infamous Target credit card hack might have just done it again. This time via his blog he’s reporting the following:

Multiple banks say they are seeing evidence that Home Depot stores may be the source of a massive new batch of stolen credit and debit cards that went on sale this morning in the cybercrime underground. Home Depot says that it is working with banks and law enforcement agencies to investigate reports of suspicious activity.

Lovely. Now Home Depot is investigating, and affected customers will be contacted, but this does not give me the warm fuzzies at all. That’s because this hack may have occurred in late April or early May and could encompass all 2,200 of the company’s stores in the U.S. So not only is there a very long lag time between the hack and when it was discovered, but it also potentially is bigger than the Target hack.

Scary.

2 Comments »