Home Depot data breach: 56 million payment cards put ‘at risk’

Home Depot Inc. said an investigation found that a data breach exposed about 56 million payment cards, part of a cyber attack that trumped even Target’s massive hack last year.

The home improvement chain said hackers built unique malware to penetrate the company’s systems between April and September. In comparison, Target’s data breach compromised 40 million credit and debit card accounts over a period of about three weeks.

“The malware had not been seen previously in other attacks,” Home Depot said in a Thursday statement. “The hackers’ method of entry has been closed off.”

The Atlanta company said the malware has been removed, security has been tightened at its U.S. stores and any terminals with malware have been removed.

The investigation found no evidence that debit personal identification numbers had been stolen, or that hackers got data from stores in Mexico or from those who shopped online.

Security journalist Brian Krebs first reported this month that Home Depot may have been the source of a “massive” trove of debit and credit card information that went on sale in the “cybercrime underworld”

Krebs, who broke the story of the Target data breach last year, said card data that began popping up at the cybercrime store Rescator indicated a big U.S. retailer had been breached. Rescator was a prime digital storefront for peddling stolen payment information after the hacks at Target, P.F. Chang’s and Sally Beauty Holdings Inc., Krebs said.

It remains to be seen how much backlash Home Depot will experience from customers who may shy away from shopping at its stores.

Despite efforts to move beyond its own data breach, Target last month slashed its profit forecast for the year after seeing its second quarter net income plunge by nearly 62%. The hack cost the company $148 million in that quarter alone.

Home Depot sought to quickly assure investors on Thursday by reaffirming its sales forecast of 4.8% for fiscal year 2014. It also increased its 2014 earnings guidance by 2 cents to $4.54.

“Third quarter sales, including sales in September, are on plan,” the company said.

Twitter: @ShanLi