Third-Party Vendor Compromise

Home Depot Data Breach April 2014

Prevented by: HSF, PEC, EGR

The Home Depot data breach, occurring in April 2014, resulted in the theft of over 56 million payment card records through custom-built malware targeting point-of-sale systems across the US and Canada. Organized cybercriminal groups deployed POS-scraping malware using stolen vendor credentials, exfiltrating high volumes of financial data. This incident highlights significant vulnerabilities in third-party access management and the effectiveness of traditional security measures against advanced threats.

Target Data Breach 2013

Prevented by: HSF, PEC, EGR

The Target data breach of 2013 exposed approximately 110 million customer records, including 40 million credit and debit card numbers and 70 million sets of personal data. The breach occurred when attackers gained unauthorized access through compromised credentials from a third-party vendor, using RAM scraping malware to extract data from point-of-sale systems. This incident highlights significant security vulnerabilities in vendor management and network segmentation.

Court Ventures (Experian) Data Breach

In October 2013, a Vietnamese threat actor accessed Court Ventures’ database, compromising approximately 200 million personal records including Social Security numbers and credit card details. The breach occurred through exploitation of data-sharing vulnerabilities and inadequate verification processes, highlighting a major security lapse in third-party partnerships.

California Department of Child Support Services Data Breach

In 2012, the California Department of Child Support Services experienced a data breach when magnetic tapes were lost in transit, compromising the personal data of 800,000 individuals, including names, addresses, and Social Security numbers. This incident highlighted vulnerabilities in physical media security and the absence of encryption, with no involvement of external threat actors.