Home Depot Hit By Same Malware as Target
The apparent credit and debit card breach uncovered last week at Home Depot was aided in part by a new variant of the same malicious software program that stole card account data from cash registers at Target last December, according to sources close to the investigation.
Context & Ripple Effects
This is the second act of a story that has been building all year. After [[a:1201829|Target confirmed in January that point-of-sale malware was used in its holiday-season breach]], analysts pulled apart the malicious software itself in Krebs' first look at the Target intrusion — so when banks began flagging a fresh flood of stolen cards traced to another retailer on September 2, the fingerprint comparison to Target was the obvious next question.
That question now appears answered: sources close to the investigation tell Krebs the Home Depot breach ran on a new variant of the same malware, and the company itself confirmed the same day that its payment systems were breached for months, exposing card numbers but not PINs (Home Depot's confirmation of the breach). The story traveled unusually fast — Reuters, NYT, The Verge, Ars Technica, Fortune and others all picked it up within hours, reflecting how much weight the Target parallel carries after Target's own breach cost CEO Gregg Steinhafel his job in May.
First-order effects
- Card-issuing banks face an immediate wave of fraud losses and reissuance costs on Home Depot cards, repeating the burden they absorbed after the Target breach — which is why banks were the ones who surfaced this breach publicly before Home Depot acknowledged it.
- Home Depot is now managing a confirmed months-long intrusion under the scrutiny Target faced, with its brand and liability exposure shaped by how visibly it cooperates with banks and investigators.
Second-order effects
- Retailers watching the second major big-box POS compromise in nine months face pressure to accelerate checkout-security upgrades and malware detection at the register, since the same tooling is demonstrably being reused against multiple chains.
- Payment processors and card networks gain leverage to push US merchants toward more secure card technologies, using the recurring cost of magnetic-stripe breaches as the argument.
Third-order effects
- If off-the-shelf POS malware keeps compromising major chains, register security stops being an IT line item and becomes a board-level risk — Target's CEO ouster in May established the precedent that a breach can cost executives their jobs.
- A pattern of one malware family hitting multiple retailers points toward industry-wide standardization of payment-terminal defenses rather than chain-by-chain fixes, with regulators and card networks as likely enforcers.
The trend: Point-of-sale malware is becoming a reusable attack template across US big-box retail, turning each new breach into both a fraud event and a test of executive accountability.