Home Depot Ignored Security Researcher’s Warning About Exposed Credential Security researcher Vinny Troia (operating under the alias "Zimmerman") disclosed that Home Depot failed to respond to multiple alerts about a publicly exposed credential, despite his history of reporting similar vulnerabilities to other companies. Troia, who has previously notified organizations about security risks, stated that Home Depot was the only company to ignore his warnings. The exposed credential was removed from public view only after TechCrunch reached out to Home Depot last week. The incident highlights potential gaps in the company’s vulnerability disclosure process, though no details were provided on whether the credential was misused or the extent of its exposure. The case underscores the risks of unaddressed security alerts in enterprise environments.

Home Depot was listed among the 39 victims of the Scattered Lapsus$ Hunters cybercrime group, which breached corporate Salesforce instances via social engineering. The stolen data includes personal and contact information of customers, employees, and partners, with specific risks tied to a dedicated file containing government employees' details—names, email/postal addresses, and phone numbers. This exposure heightens risks of targeted phishing, fraud, and even political violence against individuals. The breach also involves sensitive data like account IDs, dates of birth, passport/Social Security numbers, and purchase histories, which could fuel identity theft or financial fraud. The group threatens to publicly leak the data unless a ransom is paid by October 10, 2025, leveraging pressure through a dark web leak site. Salesforce denies platform compromise but acknowledges extortion attempts linked to past incidents.

In one of the most significant cybersecurity breaches impacting the retail sector, Home Depot faced a formidable cyber attack between April and September 2014. Using a third-party vendor's login credentials, attackers infiltrated Home Depot’s network, then deployed sophisticated malware designed to infect the retailer’s POS system, aiming to harvest customer payment information. This breach had a massive scope, affecting 52 million customers. It caused considerable financial and reputational damage to the company. Home Depot subsequently agreed to pay $17.5 million to settle claims across the country, linked to this incident. However, this sum was only a part of the overall financial impact on Home Depot, which incurred pretax expenses of $198 million related to the breach, its aftermath, and subsequent litigation by customers, payment card issuers, and financial institutions before reaching the settlement. This event underscores the critical importance of stringent cybersecurity measures and the potential consequences of vulnerabilities within third-party vendor systems.

In 2014, Home Depot experienced a major security breach that compromised over 50 million credit cards. Cybercriminals exploited a third-party vendor’s credentials to access the network and install malware on point-of-sale systems. As customers swiped their credit cards at physical stores, their data was clandestinely captured by the attackers, posing serious privacy and financial risks.

The California Office of the Attorney General reported a data breach involving The Home Depot, Inc. on September 9, 2014. The breach potentially impacted customers using payment cards at Home Depot stores in the U.S. and Canada from April 2014 onward, involving payment card information including names, credit card numbers, and expiration dates. There is no evidence that debit PIN numbers were compromised.

The California Office of the Attorney General reported a data breach incident involving The Home Depot, Inc. on February 10, 2014. The breach relates to unauthorized access by three HR associates to the personal information of current and former associates, potentially including names, contact information, social security numbers, and financial account numbers. However, the exact number of affected individuals and the breach date were not specified.