The Home Depot, the world's largest home improvement retailer, today disclosed additional findings related to the recent breach of its payment data systems. The findings are the result of weeks of investigation by The Home Depot, in cooperation with law enforcement and the company's third-party IT security experts.

Additional Investigation Details Disclosed 
In addition to details previously released, the investigation to date has determined the following:

• Criminals used a third-party vendor's user name and password to enter the perimeter of Home Depot's network.  These stolen credentials alone did not provide direct access to the company's point-of-sale devices.  
• The hackers then acquired elevated rights that allowed them to navigate portions of Home Depot's network and to deploy unique, custom-built malware on its self-checkout systems in the U.S. and Canada.  
• In addition to the previously disclosed payment card data, separate files containing approximately 53 million email addresses were also taken during the breach.  These files did not contain passwords, payment card information or other sensitive personal information.  The company is notifying affected customers in the U.S. and Canada. Customers should be on guard against phishing scams, which are designed to trick customers into providing personal information in response to phony emails. Information about how to avoid phishing and other email scams is available by typing https://www.onguardonline.gov/articles/0003-phishing into your web browser.

As previously disclosed, the malware used in the attack had not been seen in any prior attacks and was designed to evade detection by antivirus software, according to Home Depot's security partners.  As the company announced on September 18, the hackers' method of entry has been closed off and the malware has been eliminated from the company's systems.

The Home Depot's investigation, cooperation with law enforcement and efforts to further enhance its security measures are ongoing.  The company does not anticipate further updates on the breach outside of its quarterly financial disclosures.

The Home Depot continues to offer free identity protection services, including credit monitoring, to any customer who used a payment card at a Home Depot store in 2014, from April on. Customers who wish to take advantage of these services can learn more at www.homedepot.com or by calling 1-800-HOMEDEPOT (800-466-3337).  Customers in Canada can call 800-668-2266.

Cyber Security Enhancements

Enhanced Encryption
The company has implemented enhanced encryption of payment data in all U.S. stores. The new security protection locks down payment card data, taking raw payment card information and scrambling it to make it unreadable and virtually useless to hackers. Home Depot's encryption technology, provided by Voltage Security, Inc., has been tested and validated by two independent IT security firms. 

Though initially launched in January 2014 as part of a strategic plan to expand security beyond those protections already in place, implementation of the project was accelerated after the breach and completed in all U.S. stores on September 13, 2014. The rollout to Canadian stores will be completed by early 2015.

EMV Chip-and-PIN Technology
The company is rolling out EMV chip-and-PIN technology, which adds extra layers of payment card protection for customers. Chip-and-PIN technology was deployed to Canadian stores in 2011.  Launched as a project for U.S. stores in January 2013, the project will be completed ahead of the payment industry's deadline. 

Prior Guidance Confirmed
The Home Depot will release its third quarter results on Tuesday, November 18.  The company today confirmed its previous fiscal 2014 sales growth guidance of approximately 4.8 percent and its fiscal 2014 diluted earnings per share growth guidance of $4.54, an increase of approximately 21 percent, which includes estimates for the cost to investigate the data breach, provide credit monitoring services to customers, increase call center staffing, and pay legal and professional services, all of which are expensed as incurred.