Slashdot Mirror
Home Depot Says Hackers Grabbed 53 Million Email Addresses
wiredmikey writes Home Depot said on Thursday that hackers managed to access 53 million customer email addresses during the massive breach that was disclosed in September when the retail giant announced that 56 million customer payment cards were compromised in a cyber attack. The files containing the stolen email addresses did not contain passwords, payment card information or other sensitive personal information, the company said. The company also said that the hackers acquired elevated rights that allowed them to navigate portions of Home Depot's network and to deploy unique, custom-built malware on its self-checkout systems in the U.S. and Canada.
Derp
consistently reinforce their legacy retailing status.
TFA says that Home Depot expects to pay "$62 million this year to recover from the incident", referring to exposing the details on 56 million credit cards. That's only $1.11 per exposed card. I used a credit card there during the period, so my Credit Union sent me a new card, plus two other physical letters about the incident. That had to cost them more than $1.11 per affected customer.
I do remember the face of a nice cashier lady in a rural Home Depot — she asked me to "sign up for free" and I refused. It genuinely offended her, though she remained professionally nice... Maybe, now she understands.
And when you have to — or, despite the risks, want to — register with some company, always use an address like yourid+companyname-year@example.com. The nifty feature supported by most mail-servers will still deliver the message into your mbox, but you'll be able to block a particular address, when it gets stolen (or when the party you gave it to in the first place turns to spamming).
GMail supports the feature, Yahoo! Mail might too.
(Of course, owners of their own domains have the infinite supply of even nicer-looking addresses.)
In Soviet Washington the swamp drains you.
fight the power!
And they're a member of CurrentC who wants your bank account info, driver's license and SSN numbers. Who in their right mind would give the MCX or its members companies such info?
Should have hired me instead asshats!
Seems like one of the jobs of IT departments for the last 10 years should have been to have their own surveillance software to be watching for activities that indicate software changes, moving of data, and added code that should be detectable so they can verify what is happening to their systems in near real time.
Glad that's over!
It's not over.
Which part of "Microsoft product" did Home Depot not understand?
According to an Oct. 1, 2013, report prepared for Home Depot by consultant FishNet Security, the retailer left its computers vulnerable by switching off Symantec’s Network Threat Protection (NTP) firewall in favor of one packaged with Windows.
http://www.businessweek.com/ar...
Did your credit union send the letters, or did Home Depot?
Home Depot isn't paying for your card, and a letter isn't that expensive when you are buying office supplies in bulk.
For a corporation with $78 Billion in revenue, $62 million is like you paying the paperboy his Christmas bonus.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
According to an Oct. 1, 2013, report prepared for Home Depot by consultant FishNet Security, the retailer left its computers vulnerable by switching off Symantecâ(TM)s Network Threat Protection (NTP) firewall in favor of one packaged with Windows.
No enterprise installation should ever be relying on individual client firewall software for network security. At best, that should be a second line of defense. It is the job of the perimeter firewall to handle these kind of threats.
Time to switch to CurrentC and hand over all my information to the people in the MCX. They're so responsible and knowledgable about information security and real world threats!
This will get you EVERYTIME.
Yes, Home Depot offshored significant amounts of their admin. THis allows India to work on the computers in the middle of the night. However, like target, and the others, it enables ppl that have NO VESTED INTEREST in the company, or the nation, to have access to production.
This will continue as long as companies continue to cheat.
I prefer the "u" in honour as it seems to be missing these days.
"the hackers acquired elevated rights that allowed them to navigate portions of Home Depot's network and to deploy unique, custom-built malware on its self-checkout systems in the U.S. and Canada."
What Operating System did this self-checkout system run on?
I have personally had problems with Home Depot's quality I shop at the local hardware stores instead
And if they are already inside your network from an unsecured port on a wall somewhere, or through internal wireless?
Point-of-sale systems should be firewalled out the ass.
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
[sarcasm]Man, I can't wait to sign up for Current C and give them direct access to my bank account and all my personal information![/sarcasm]
-TheDawgLives suckitdown
Dear Valued Customer,
The Home Depot has discovered that a file containing your email address may have been taken during the payment card breach we announced in September. The file contained email addresses, but it did not contain passwords, payment card information, or other sensitive personal information. We apologize for this incident and for the inconvenience and frustration this may cause you.
In all likelihood this event will not impact you, but we recommend that you be on the alert for phony emails requesting personal or sensitive information. If you have any questions or would like additional information on how to protect yourself from email scams, please visit our website or call 1-800-HOMEDEPOT.
Again, we apologize for the frustration and inconvenience this incident may have caused. Thank you for your continued support.
Sincerely,
The Home Depot
I was struck by how the letter did not say anything about what HD has done to ensure that something like this will not happen again to them.
My personal email was under good control for blocking junk mail via my SpamAssassin filter and local junk box filters, up until around the time the breach was announced. Since then I have been receiving a dozen or so very well crafted spam emails, all text and all formatted in a similar fashion, containing a row or two of lines with a "reference number" "case number" or something along those lines.