Possible data breach at Home Depot highlights retailers vulnerability

Los Angeles Times

The possible data breach at Home Depot Inc. that came to light this past week has raised anew the question of whether retailers can prevent or at least do more to stop hackers from swiping customer information.

The home improvement chain said it was working with law enforcement, banking partners and security agencies to investigate unusual activity but as of Friday had not confirmed whether a breach has occurred.

On Tuesday, security journalist Brian Krebs reported on his website that Home Depot may be the source of a massive trove of debit and credit card information that went on sale in the cybercrime underworld.

Home Depot spokeswoman Paula Drake said Wednesday that our forensics and security teams have been working around the clock since we first became aware of a potential breach Tuesday morning. ... There is no higher priority for us at this time.

If payment data were stolen, Home Depot would join a pack of other companies including Michaels, Neiman Marcus, P.F. Changs and Target Corp. that have been targeted by hackers who made off with debit and credit card information from customers.

Security experts say large companies can never completely shield themselves against cybercriminals, but many can improve their odds by focusing more attention on closing loopholes in their system.

The reality we live in today is any company is bleachable, said Aleksandr Yampolskiy, chief executive of SecurityScorecard Inc., which rates businesses on the level of their security. If someone is determined enough, they can hack into any company. And for the biggest companies, its nearly impossible to secure all of the weakest links.

As a safeguard, some U.S. retailers have said they will adopt cards with embedded chips that many other countries use in place of cards with magnetic strips that store personal information, which can be more easily counterfeited.

In the past, the high cost of this EMV system named for its developers: Europay, MasterCard and Visa has prevented wide adoption by U.S. companies. Instead, credit companies created the Payment Card Industry Security Standards Council in 2006 to push for better protections against consumer data theft.

Original post:
Possible data breach at Home Depot highlights retailers vulnerability