53m e-mail addresses also taken in hacker attack: Home Depot
New York
HOME Depot Inc, which suffered a data breach between April and September, said that 53 million e-mail addresses were taken by hackers during the attack, in addition to the 56 million payment cards that were previously disclosed.
Home Depot also said on Thursday that the criminals used a third-party vendor's user name and password to reach the perimeter of its network, then gained additional rights to navigate the company's systems. Hackers used custom-built software on Home Depot's self-checkout terminals in the US and Canada to access customer data, according to a statement.
"Customers should be on guard against phishing scams, which are designed to trick customers into providing personal information in response to phoney e-mails," the Atlanta-based company said.
Home Depot, which first acknowledged the attack in September, has become one of the biggest victims of hackers' war on retailers. The world's largest home-improvement chain has said that it expects to pay about US$62 million this year to recover from the incursion, including additional costs for call-centre staffing and legal expenses. Insurance will cover US$27 million of that tab, the company said.
The latest information stemmed from weeks of work by investigators, who are cooperating with law enforcement and information-technology specialists, Home Depot said. The e-mail data that was stolen didn't include passwords or other sensitive information, the company said.
Home Depot began investigating the breach on Sept 2, immediately after banking partners and law enforcement raised alarms that its systems may have been infiltrated. The malicious software used in the breach hadn't been seen in previous attacks and was designed to evade detection by anti-virus software, the company has said. The vulnerability has been closed off, and Home Depot has eliminated the malware from its systems.
A third-party vendor was also the root of Target Corp's breach last year, when hackers stole about 40 million payment-card numbers at the height of the holiday season. Bloomberg
