Home Depot 2014: $198M, the second retail POS breach that finished the EMV argument.

The intrusion began with a third-party vendor. Attackers obtained a vendor's username and password and used them to log in to a peripheral part of Home Depot's network. Those credentials did not grant direct access to the payment environment; instead the attackers exploited a Windows vulnerability to elevate privileges and move laterally, eventually reaching the point-of-sale systems. The entry pattern was near-identical to the Fazio-vendor pivot that had breached Target nine months earlier, which is part of why the case landed so heavily in the retail sector.

On the POS terminals the attackers installed a custom strain of memory-scraping malware that Home Depot's security team reported having never seen before, a variant of the same BlackPOS/FrameworkPOS family used against Target. The malware read unencrypted payment-card data out of terminal memory at the moment of swipe. Critically, the infection was confined to the self-checkout terminals rather than the full cashier-staffed register fleet, which limited the compromise to roughly a subset of transactions but still exposed 56 million cards over the five-month window. Home Depot later confirmed that 53 million customer email addresses were taken in the same intrusion.

The five-month dwell time, from around 10 April to 13 September 2014, is the detail that defines the case. As with Target, the failure was not a single missing control but a chain: an over-trusted vendor account, insufficient network segmentation between the vendor-facing network and the card environment, and POS terminals processing card data in cleartext in memory. Home Depot disclosed the breach publicly on 8 September 2014 after security reporter Brian Krebs surfaced evidence of stolen cards traced to its stores, and confirmed the malware had been removed by mid-September.

Primary source:Breach mechanics and scale from Home Depot press statements (September and November 2014), CNN Money and NBC News reporting on the 53 million stolen email addresses (6 November 2014), and Infosecurity Magazine reporting on the third-party vendor credential vector.

The $198M headline is the cumulative pretax net figure Home Depot disclosed in its fiscal-2016 Form 10-K: gross pretax expenses of roughly $298M, offset by approximately $100M of expected insurance proceeds. The litigation settlements listed above are the components that resolved the breach rather than four separate additions on top of the net total; the payment-card recovery, consumer and financial-institution settlements sit inside the expensed figure, while the $17.5M multistate settlement was reached in November 2020, after that 10-K. The insurance recovery of roughly one third of gross cost mirrors the Target precedent that cyber-insurance ran materially below total breach exposure for large retailers in this era.

The consumer class action settled first. In 2016 Home Depot agreed to a $19.5M fund covering documented out-of-pocket losses for affected cardholders plus 18 months of identity-protection services, along with a commitment to specific security improvements. The per-person recovery was modest, consistent with payment-card breaches where issuers, not cardholders, absorb the direct fraud loss through reissuance and chargebacks.

The financial-institution litigation was the more consequential track. More than 60 banks and credit unions consolidated their claims, arguing that Home Depot's security failures forced them to bear reissuance and fraud-reimbursement costs. In March 2017 Home Depot agreed to pay $25M into a fund for institutions that had not already released their claims, plus a further $2.25M for certain institutions whose claims had been released, along with notice and administration costs. That settlement, layered on the roughly $134.5M Home Depot had already paid the card networks and banks through card-brand recovery programs, is why Fortune reported the breach's costs had topped $179M by March 2017.

The regulatory track closed last. On 24 November 2020 Home Depot settled with a coalition of 46 state attorneys general and the District of Columbia for $17.5M, alongside a set of injunctive security requirements: appointing a chief information security officer, deploying specific safeguards for cardholder data, and maintaining a documented information-security program subject to third-party assessment. The six-year gap between the breach and the AG settlement is itself instructive on the long tail of breach cost, the same pattern the Target case established.

Primary source:Settlement figures from the consumer class settlement (N.D. Georgia, 2016), In re: The Home Depot, Inc., Customer Data Security Breach Litigation financial-institution settlement (2017, reported by Crowell & Moring and Patterson Belknap), Fortune reporting on the aggregate cost (9 March 2017), and the multistate attorneys-general settlement announcements of 24 November 2020 (New York, Texas, and Delaware AG press releases).

Target on its own had already moved EMV chip migration up the retail agenda, but the arrival of a near-identical breach at a second national retailer within nine months is what removed the remaining resistance. The EMV liability shift for US card-present transactions had been scheduled by Visa and Mastercard for October 2015 before either breach; the two cases turned a deferrable capital project into a board-level mandate. Home Depot itself accelerated its chip-reader rollout, completing enablement across its US stores ahead of the liability-shift deadline.

The structural lesson the pair delivered was that magstripe POS data in terminal memory was the crown jewel and that chip-and-PIN or chip-and-signature broke the counterfeit-card economics behind these breaches. Visa reported that counterfeit-fraud dollars at fully chip-enabled US merchants fell 87% between September 2015 and March 2019. Home Depot and Target were the two single largest catalysts for that investment cycle, and after 2015 large-scale magstripe-clone breaches of this exact shape became markedly rarer as the card-present attack surface shifted toward card-not-present fraud online.

One contrast with Target is worth recording. Target's breach produced the first CEO departure attributable to a data breach, when Gregg Steinhafel resigned in May 2014. Home Depot saw no comparable executive fallout: its leadership transition through this period was already in train and was not framed as a consequence of the breach. The divergent governance outcomes, similar breach mechanics but very different executive consequences, became a case study in how much the board and market reaction depends on framing, timing, and the perceived adequacy of the response rather than on breach scale alone.