MisuseRetail & ConsumerRetailPrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Financial accountMediumContained

HOME DEPOT U.S.A., INC.

bd_d1fcaa13946e6f89 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

May 27, 2014

To disclose

—

Affected · nationwide

30,0001 in this filing

Confidence

66%

Full breach record for HOME DEPOT U.S.A., INC. →4 incidents on file

Home Depot notified NH AG of an insider incident (May 7-21, 2014) where a terminated employee misused authorized access to steal credit card data from ~30,000 accounts, including 1 NH resident. Data included names, addresses, DOBs, and card numbers. No SSN/PIN/CVV. Home Depot terminated the employee, cooperated with law enforcement, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

May 7, 2014

Begins

May 27, 2014

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed30,000 affectedView incident

Name: HOGAN LOVELLS US LLP
norm: hogan lovells us

Name: HOME DEPOT U.S.A., INC.
norm: home depot usa
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: May 7, 2014 – May 21, 2014
Materiality determined: —
Notification sent: May 27, 2014
Affected individuals: 30,000state + nationwide
Data types: Identity (basic)Financial account
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: InternalFinancial
Regulator citations: Notification of Potential Data Breach Pursuant to N.H. Rev. Stat. § 359-C:20
Initial access: insider_action

During the incident: Terminated his employment
Cooperating with federal law enforcement
Seek the prosecution of this individual
Electronic devices have been seized by law enforcement
Providing written notification by mail
Provided with credit monitoring services for a 12-month period
Changes made: Review its access controls
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/home-depot-20140527.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 27, 2014
Raw hash: 63cbb5350adf3e0e9fba068cff0c565f2c9028a89801083e3687206b2754b27a

Reporting entityHOGAN LOVELLS US LLP

Victim entityHOME DEPOT U.S.A., INC.

IncidentInsider

Stated responseTerminated his employment

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov