Home Depot's breach stole 56M payment cards — the hackers used a vendor's credentials

In September 2014, Home Depot disclosed that hackers had stolen approximately 56 million payment card numbers from its point-of-sale systems. The breach, which lasted from April to September 2014, was the largest retail data breach at the time, surpassing the Target breach of 2013.

The hackers gained access using credentials stolen from a third-party vendor, then installed malware on Home Depot's self-checkout systems. The malware captured card data as customers swiped their cards. Home Depot's security team detected unusual activity but did not identify the breach for several months.

Home Depot paid over $200 million in settlements, legal costs and security upgrades. The case illustrated the same supply chain vulnerability as the Target breach: a third-party vendor's credentials became the entry point for a catastrophic breach. The case prompted the retail industry to accelerate the adoption of EMV chip card technology.