Home Depot on Friday disclosed additional details of the breach we first heard about earlier this year, revealing that the hackers also accessed files containing 53 million email addresses.
These files did not contain passwords, payment card information, or other sensitive personal information, Home Depot said. The company is now in the process of notifying affected customers, who can sign up for free identity protection and credit monitoring services at Home Depot's expense.
Home Depot in September first acknowledged that attackers had compromised the point-of-sale terminals used at its self-checkout counters, and stole 56 million unique payment card numbers.
Affected individuals should be on guard against phishing scams, which are designed to trick you into handing over your personal information in response to phony emails.
Home Depot said the hackers somehow obtained a third-party vendor's username and password, and used those credentials to enter its network. The stolen credentials alone did not, however, provide direct access to the Home Depot's point-of-sale devices.
The hackers then managed to acquire elevated rights, which allowed them to break into more restricted portions of the network and plant custom-built malware on the company's self-checkout systems in the U.S. and Canada.
The malware had not been seen in any prior attacks and was designed to evade anti-virus software. As of Sept. 18, the hackers' method of entry was closed off and the malware eradicated from the company's system.
Following the breach, Home Depot implemented enhanced encryption technology in all its U.S. stores. The technology essentially locks down payment card data, scrambling it to make it unreadable and virtually useless to hackers.
The exploit used in the Home Depot hack, known as Backoff malware, also hit a number of high-profile retailers like Target, Dairy Queen, Kmart, Jimmy John's, P.F. Chang's, and Goodwill. Unfortunately, Backoff shows no signs of slowing down: Network security firm Damballa detected a 57 percent rise in infected devices in August, and that number grew another 27 percent in September.
Meanwhile, a survey of more than 1,000 U.S. consumers, released this week by RSA in conjunction with the Ponemon Institute, found that nearly half of respondents had fallen victim to at least one data breach. Forty-five percent said they are not confident that they are aware of all the times their personal information was leaked.
If you're a JPMorgan Chase customer, you might want to check on your info. A cyberattack on the bank this summer compromised the personal information of 76 million households and 7 million small businesses, making it one of the largest data breaches ever. For more, see the video below.