Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Home Depot said malware in its payment network exposed approximately 56 million unique payment cards during 2014. After investigators identified the intrusion, the retailer announced that enhanced encryption was complete in U.S. stores. That encryption added an important protection layer, but it was not a guarantee that malware could never read card data inside a payment terminal.
What happened in the Home Depot breach?
Home Depot said the malware was believed to have been present from April through September 2014. The company began investigating on September 2 after reports from banking partners and law enforcement, then publicly confirmed the payment-system breach on September 8.
In a September 18, 2014 announcement, Home Depot said approximately 56 million unique payment cards had been put at risk. “Unique payment cards” is the company’s figure for cards at risk; it should not be read as a confirmed count of individual people.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The company later disclosed a separate theft involving files containing approximately 53 million email addresses. Home Depot reported that additional information on November 6, 2014, while reiterating that enhanced encryption was operating in its U.S. stores.
#1 Best Overall
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Rugged Double-Layer Waterproof* Design - Protects the crypto drive against knocks, drops, break-in and submerging in water. The electronics are shielded by a hardended inner case. The rubberised silicone outer casing provides a final layer of protection
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
Home Depot breach timeline
| Date or period | What Home Depot reported |
|---|---|
| April–September 2014 | Malware was believed to have been present in the payment environment. |
| September 2, 2014 | The company said it began investigating after reports from banking partners and law enforcement. |
| September 8, 2014 | Home Depot publicly confirmed the payment-system breach. |
| September 13, 2014 | Home Depot said its enhanced-encryption rollout was complete in U.S. stores. |
| September 18, 2014 | The company announced malware elimination from its U.S. and Canadian networks and described the completed U.S. encryption project. |
| November 6, 2014 | Home Depot reported the separate theft of approximately 53 million email addresses. |
What encryption did Home Depot add?
Home Depot said its encryption project had started in January 2014, before the breach was publicly confirmed. The retailer said the U.S. rollout was completed on September 13, five days after its public confirmation, and that the Canadian rollout was expected to finish by early 2015.
The technology was provided by Voltage Security and validated by two independent IT security firms, according to Home Depot. The company described the system as taking raw payment-card information and scrambling it “to make it unreadable and virtually useless to hackers.” That wording is Home Depot’s characterization, not a universal guarantee about every stage of a payment transaction.
Rank #2
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
- SuperSpeed USB 3.0 - Transfer all your confidential files and folders faster than ever before. Works on both PC & Mac
Encryption is intended to protect payment data when it is stored or transmitted in protected parts of a payment system. It does not automatically remove malicious software from a terminal, stop an attacker who has access to the terminal’s operating environment, or secure unrelated files such as stolen email-address records.
Why encryption did not eliminate the malware risk
Contemporaneous reporting by CRN noted that payment-card data could be held briefly in cleartext in terminal memory. Malware operating on a compromised point-of-sale terminal could potentially target that moment before the data was encrypted or after it had been decrypted for processing.
Rank #3
- Certified to FIPS 197 - U.S. Government Approved High Level Information Security Standard.
- Protection against brute force password attacks - Data is automatically erased after 6 unsuccessful access attempts. The data of the USB flash drive type c encryption with dual connectors is destroyed and the cryptographic drive is reset.
- Durable dual-layer waterproof design* — Protects the crypto reader from bumps, drops, run-in and immersion in water. The electronics are protected by a hardened internal case. Rubberized silicone outer case provides a final layer of protection.
- Auto-Lock —The cryptographic key automatically encrypts all data and locks when removed from a PC/Mac or when screen protection or "computer lock" is enabled.
- Secure Entry —Data on these flash drives cannot be accessed without the correct alphanumeric password of 8 to 16 characters. A password indication option is available for this flash drive. The hint cannot match the password.
That distinction explains why the encryption announcement should be viewed as a layer of defense rather than proof that hackers could no longer steal card data. Protecting data at rest or in transit and preventing malware from running on a payment terminal are different security problems.
How the other planned measures fit
Enhanced encryption
Encryption was aimed at reducing the usefulness of intercepted payment information outside the protected processing path. Home Depot said the U.S. store rollout was complete in September 2014, with the Canadian deployment planned for early 2015.
Rank #4
- FIPS 197 with XTS-AES 256-bit Encryption: Provides business-grade security with hardware-based encryption to protect your sensitive data
- Brute Force and BadUSB Attack Protection: Safeguards against unauthorized access attempts and malicious USB attacks with digitally-signed firmware
- Multi-Password Option with Complex/Passphrase modes: Offers flexible password configuration options to meet various security requirements and user preferences
- New Passphrase Mode: Enhanced security feature allowing users to create longer, more memorable password phrases for easier access without compromising protection
- Dual Read-Only (Write-Protect) Settings: Enables write protection functionality to prevent accidental data modification or deletion when needed
EMV chip-and-PIN
Home Depot said it planned to deploy EMV chip-and-PIN capability in U.S. stores by the end of 2014. Chip authentication addresses counterfeit-card fraud differently from encryption; it does not replace network monitoring or malware controls.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Malware detection and containment
The company said it had eliminated the malware from its U.S. and Canadian networks. Detection, investigation, eradication and segmentation are operational controls designed to keep malicious code from collecting data in the first place. They are complementary to encryption, not interchangeable with it.
Best Value
- FIPS 140-2 Level 3 Validation (pending 1 Q 2019)
- Aegis Configurator Compatible
- Separate Admin and User Mode
- Two Read-Only Modes
- Data Recovery PINs
What information did Home Depot say was not affected?
Home Depot said there was no evidence that debit PIN numbers had been compromised. It also said the incident did not affect its Mexico stores or online shoppers. These are statements by the company about the scope known at the time, not a general finding that every customer account was unaffected.
Chairman and CEO Frank Blake apologized for the “inconvenience and anxiety” and said customers would not be liable for fraudulent charges. Cardholders should still review statements and contact their issuer if they see transactions they do not recognize; the issuer controls the applicable dispute process.
What happened after the incident?
The later official settlement FAQ described a $13 million settlement fund and security-program commitments that included enhanced encryption and security measures for card transactions. The FAQ’s publication date is not specified here, and the historical record does not establish current settlement eligibility.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →The breach remains a useful example of why payment security uses multiple controls. Encryption can limit the value of stolen data, while endpoint protection, access controls, monitoring, rapid containment and chip technology address different points in the attack chain. None should be presented as eliminating risk on its own.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
