Banks: Credit Card Breach at Home Depot
Multiple banks say they are seeing evidence that Home Depot stores may be the source of a massive new batch of stolen credit and debit cards that went on sale this morning in the cybercrime underground. Home Depot says that it is working with banks …
Context & Ripple Effects
The playbook here is the one written by Target nine months earlier: banks spot a flood of fresh stolen cards in the cybercrime underground, trace the common point of purchase, and go public before the retailer confirms anything — exactly the sequence Krebs documented in the Target investigation and the subsequent dump of stolen cards flooding underground markets.
What is confirmed so far is narrow: Home Depot says it is working with banks, and batches of cards linked to its stores are on sale. The banks' attribution of the source remains unconfirmed, which is why the story travelled fast — BBC, the New York Times, Fortune and CNBC all picked it up on day one — but rests on issuer-side fraud evidence rather than a company admission.
First-order effects
- Card-issuing banks absorb the immediate cost: monitoring accounts for fraud on cards that shopped at Home Depot and deciding whether to reissue at scale, the same burden Target's breach forced on them.
- Home Depot faces an unconfirmed-but-public breach narrative while its investigation runs, with the confirmed sale of its customers' cards already doing reputational damage regardless of what its forensics conclude.
Second-order effects
- If the Home Depot attribution firms up the way Target's did, every large US retailer becomes subject to the same detection method — banks triangulating dump locations — turning point-of-sale security into a board-level issue across the sector.
- Payment networks and processors come under renewed pressure from issuers who bear the fraud losses, sharpening the fight over who pays when retailer systems are breached.
Third-order effects
- A repeat of the Target pattern at a second national chain points to retail point-of-sale infrastructure as a systemic attack surface, with banks — not retailers — currently acting as the de facto breach-detection layer for the industry.
- Sustained issuer losses from retailer breaches strengthen the case for shifting liability toward merchants, a structural reallocation that would change how retailers budget for payment security.
The trend: US retail is entering a stretch where massive point-of-sale breaches at national chains are detected first by banks watching underground card markets, forcing retailers into reactive confirmations.