Home Depot Data Breach

Let’s examine four recent data breaches that made nation news:

♣ Home Depot

Year: 2014

Affected: 56 million credit card accounts and 53 million email addresses.

Cost: The data breach cost the company an estimated $80 million before insurance reimbursements, according to Protection Group International.

What happened: In September 2014, Home Depot revealed that hackers had gained access to the company's computer network using stolen account information from a vendor doing business with the hardware giant.

The Home Depot data breaches exposed volumes of credit/debit card data causing consumer misery and costly retailer complications. Reports have stated that the Home Depot breach began as early as the prior April, and continued for at least four

more months before being discovered. During those four months’ cardholder data moved inside The Home Depot IT infrastructure was relocated outside the company without anyone noticing. If simple configuration auditing software had been in place, these malicious activities and security violations could have been detected much earlier which could have saved Home Depot millions of dollars. Additionally, former employees claim that they had alerted the company about the risk of a cyber attack dating back to 2008, and the company was slow to respond. Furthermore, Home Depot continuing to rely on outdated software to protect its network for years. Hackers used malware to collect customer data at cash registers. Reportedly, it took nine months for the breach to be identified and stopped [10].
♣ Sony Pictures Entertainment
Year: 2014
Affected: Personal information of about 3,000 current and former employees.

Cost: Sony estimates the cyberattacks will cost the company $35 million.

What happened: In November, Sony Pictures Entertainment was the target of a cyberattacks that leaked internal documents, including embarrassing emails and the annual salaries of senior executives. The attack also compromised employee names, social security numbers, credit card information and bank account information.

The length of the hack is still unknown, though evidence suggests that the intrusion had been occurring for more than a year, prior to its discovery. The hacker’s involved claim to have taken over 100 terabytes of data from Sony.   [11].

♣ Target

Year: 2013

Affected: 40 million credit and debit card accounts, as well as data on 70 million

customers.
Cost: Through the end of 2014, the data breach cost Target $252 million, according to corporate filings.
What happened: The breach affected credit and debit card accounts from shoppers from Nov. 27 to Dec. 15 in which personal data could have been stolen as well.
In December 2013 over 40 million credit cards were stolen from nearly 2000 Target stores by accessing data on point of sale (POS) systems. From what is known about the Target breach, there were multiple factors that led to data loss including vendors subject to phishing attacks, network segregation was lacking, point of sale systems was vulnerable to memory scraping malware and detection strategies employed by Target failed. It is believed that human factors contributed to this breach [12].
♣ Ashley Madison
Year: 2015
Affected: 33 million user accounts, including email addresses, first and last names and phone numbers.

Cost: The breach could cost the company an estimated $850 million, according to The New York Times.

What happened: In possibly the most publicized attack of the year, more than 30 million accounts on affair-site Ashley Madison, owned by Avid Life Media, were hacked and released to the public.

The Ashley Madison breach is embarrassing because it’s not just any dating site. Ashley Madison describes itself as “an online personals and dating destination for casual encounters, married dating, discreet encounter and extramarital affairs.” It was first hacked in July, and the data was made public about a month later when the blackmail campaign was not satisfied by the attackers. This is the first hack that isn’t a simple credit card hack but one that’s going to ruin marriages. For the first time, the pain caused by a breach is instantaneously attached to the breach itself

[13].
As you see, all of these data breaches involved human in which error/oversight was committed. Additionally, there was ample amount of time to prevent some of these breaches prior to the exposure if someone had just been performing the appropriate analysis as some of these breaches had been occurring for months. These four breaches only re-confirmed my experience from my prior employment in that humans can be a major vulnerability in the process. In particularly with the Target breach, as it turns out, they had implemented malware detection technology from FireEye which happened to detect the now infamous POS memory scrapping code but the IT team was running FireEye in detection rather than prevention (block) mode.  This meant that Target had to take some manual (human) action to remove the malware and remediate the incident.