(Credit: SOPA Images / Contributor / LightRocket via Getty Images)
Home Depot has confirmed the data of around 10,000 employees was exposed and published online, BleepingComputer reports.
The data includes corporate IDs, names, and email addresses, which could be used for targeted phishing attempts on the employees in order to gain access to Home Depot's network.
The data did not come directly from Home Depot's systems. Instead, a third-party software provider appears to have accidentally made it public. A hacker who goes by the moniker IntelBroker found it and then published it on a site called BreachForums.
"Today, I have uploaded the Homedepot.com database for you to download, thanks for reading and enjoy!" IntelBroker wrote on the post, shown below. IntelBroker is a repeat offender who also claimed responsibility for the March 2023 DC Health link breach affecting 170,000 US lawmakers.
Home Depot confirmed in a statement that "a third party Software-as-a-Service (SaaS) vendor inadvertently made public a small sample of Home Depot associates' names, work email addresses and User IDs during testing of their systems," according to BleepingComputer and The Register.
The attack demonstrates the vulnerabilities large corporations face when providing sensitive data to third-party suppliers, over which they do not have day-to-day control. Home Depot claims to be the world's largest home improvement retailer, with thousands of stores, a large online business, and around 500,000 total employees, according to Zippia's estimates.