2014 — Home Depot: Apr–Sep 2014, 56.0M records
Data compromised
Payment cards, emails
Technical writeup
Apr–Sep 2014. Malware on POS systems across ~2,200 stores siphoned 56M credit/debit card numbers plus 53M email addresses. Same Russian/Ukrainian group as Target breach. Stolen vendor credentials used for initial access. Custom malware evaded detection. $19.5M FTC settlement.
Root cause
POS malware; stolen third-party vendor credentials.