The world's largest DIY retailer has admitted that 56m credit and debit card numbers were compromised over a five-month period in one of the worst breaches of customer data ever recorded. Home Depot said on Thursday night that although the data theft began in April, the malware used by the hackers had only been completely removed from its systems this month.
The breach was revealed on 2 September by the security website Krebs on Security, which said that all 2,200 of Home Depot's US stores could have been affected. The chain, which did not confirm the data breach until 8 September, said that security groups Symantec and FishNet Security were brought in to investigate the possible hacking as soon it became known.
The criminals used "unique, custom-built malware" that had not been seen in similar attacks, which helped them to avoid detection for so long, Home Depot said. It had completed a major payment security upgrade to ensure better encryption of customers' card numbers.
US retailers have been slower to adopt the chip-and-Pin technology found in Britain and most European countries as many American credit cards still lacked the appropriate chips. The US payments industry has set a deadline of October 2015 to switch to chip and Pin.
Frank Blake, chairman and chief executive of Home Depot, apologised to customers for the "inconvenience and anxiety" of the breach and said they would not be liable for any fraudulent charges.
"From the time this investigation began, our guiding principle has been to put our customers first and we will continue to do so," he said.
Many banks have begun replacing credit cards affected by the theft.
The data theft eclipses the 40m card numbers stolen from Target customers last year and is second only to the 90m stolen from TJX, the owner of the TK Maxx clothing store chain, in 2007.
The company said investigating the incident had cost $62m, $27m of which would be covered by insurance payments. It was also facing a lawsuit in Canada, where as many as 4 million customers could have been affected.
Tony Merchant, a retired lawyer, who has filed a claim, told the Globe and Mail: "They weren't telling people until [security blogger] Brian Krebs broke the story at the beginning of September. An awful lot of people have spent [money] at Home Depot in the last six months, and every one of them is at risk."
The incident, while highly embarrassing for the Atlanta-based company, does not appear to have had the same impact as the breach suffered by Target. Both its chief executive and chief information officer quit in the months following the hacking.
However, Home Depot said last month that Blake would step down as chief executive on 1 November and be replaced by Craig Menear, head of the company's US retail operations.
Shares in the retailer closed up 1%, or 87 cents, at $92.09 in New York on Thursday. The stock has risen 10% in the past month.
