Home Depot says payment systems hack confirmed

NEW YORK - US retailer Home Depot said Monday its payments systems were compromised by hackers, in a data breach potentially affecting millions of customers.

The home improvement retailer said in a statement that it had "confirmed that its payment data systems have been breached, which could potentially impact customers using payment cards at its US and Canadian stores." "We apologise for the frustration and anxiety this causes our customers, and I want to thank them for their patience and support as we work through this issue," said Home Depot chairman and chief executive Frank Blake.

"It's important to emphasise that no customers will be responsible for fraudulent charges to their accounts." The news comes days after computer security researcher Brian Krebs reported that hackers had put on sale stolen credit and debit cards that apparently came from the retailer.

Krebs meanwhile reported Sunday that Home Depot had been hit by a variant of the same malware that infected retail giant Target, which disclosed last December that hackers gained access to credit card data for 40 million customers and to additional personal and identification information for 70 million other customers.

Krebs said on his blog that a source close to the investigation revealed at least some of Home Depot's store registers had been infected with a new variant of "BlackPOS" which can siphon data from cards when they are swiped at payment terminals running Microsoft Windows.

Home Depot said it did not know the extent of the breach but that it appeared personal identification codes for cards were not compromised.

"Home Depot's investigation is focused on April forward, and the company has taken aggressive steps to address the malware and protect customer data," the statement said.

The retailer said it was to offer free identity protection services to any customer who used a payment card at a Home Depot store from April of 2014.

Krebs reported there were signs that the perpetrators of the Home Depot breach may be the same group of Russian and Ukrainian hackers which hit Target, restaurant chain PF Chang's and others.

Home Depot calls itself the world's largest home improvement specialty retailer, with 2,265 retail stores in the US, Canada and Mexico. It had annual sales last year of US$78.8 billion (S$99.19 billion).