The malicious software that unknown thieves used to steal credit and debit card numbers in the data breach at Home Depot this year was installed mainly on payment systems in the self-checkout lanes at retail stores, according to sources close to the investigation. The finding could mean thieves stole far fewer cards during the almost five-month breach than they might have otherwise. 
 
 Since news of the Home Depot breach first broke on Sept. 2, this publication has been in constant contact with multiple financial institutions that are closely monitoring daily alerts from Visa and MasterCard for reports about new batches of accounts that the card associations believe were compromised in the break-in. Many banks have been bracing for a financial hit that is much bigger than the exposure caused by the breach at Target, which lasted only three weeks and exposed 40 million cards. 
 
 But so far, banking sources say Visa and MasterCard have been reporting far fewer compromised cards than expected given the length of the Home Depot exposure. 
 
 Sources now tell KrebsOnSecurity that in a conference call with financial institutions today, officials at MasterCard shared several updates from the ongoing forensic investigation into the breach at the nationwide home improvement store chain. The card brand reportedly told banks that at this time it is believed that only self-checkout terminals were impacted in the breach, but stressed that the investigation is far from complete. 
 
 MasterCard also reportedly relayed that the investigation to date found evidence of compromise at approximately 1,700 of the nearly 2,200 U.S. stores, with another 112 stores in Canada potentially affected. 
 
 Officials at MasterCard declined to comment. Home Depot spokeswoman Paula Drake also declined to comment, except to say that, “Our investigation is continuing, and unfortunately we’re not going to comment on other reports right now.” 
 
 Tags: Home Depot breach, mastercard, Paula Drake, self-checkout, target data breach, Visa 

 The breach of Home Depot’s payment systems may have compromised 56 million payment cards as a result of malware that has since been eliminated, the company said Thursday. 
 
 Attackers used unique, custom-built malware to evade detection, the company said in an update on its investigation. The malware was present between April and September of this year, the firm said in a statement. Terminals identified with malware have been taken out of service. 
 
 The retailer confirmed in September that its payment systems had been breached at stores in the U.S. and Canada, though it did not provide many more details. 
 
 Home Depot is using new encryption technology, provided by the vendor Voltage Security, to take raw payment card information and scramble it, the company said Thursday. The technology was rolled out to all U.S. stores this past Saturday, with a Canadian rollout expected to be completed early next year, Home Depot said. 
 
 There is no evidence, the firm re-iterated Thursday, that PIN numbers were compromised in the breach, or that it affected stores in Mexico or sites online. 
 
 “We apologize to our customers for the inconvenience and anxiety this has caused, and want to reassure them that they will not be liable for fraudulent charges,” said Home Depot Chairman and CEO Frank Blake in a statement. 
 
 Home Depot is one of a number of large retailers to be recently targeted by hackers. In one high-profile case, data from about 40 million credit and debit cards was stolen in a breach of Target store systems last year. 

 Martin Knuth has made so many purchases at Home Depot that he regards the store as “my second home.” 
 
 But the recent security breach at the home renovation retailer upset Mr. Knuth, a retiree who lives in Regina, Sask., so much that he volunteered to become the representative plaintiff in the first Canadian class action lawsuit against Home Depot. 
 
 The suit has been launched on behalf of all Canadian customers of retailer Home Depot Inc. who may have had their credit and debit cards hacked. 
 
 Saskatchewan lawyer Tony Merchant – a long-time class-action activist – said he filed the claim on behalf of as many as four million Canadians who have been affected. Home Depot customers could get hit with financial losses and inconvenience, Mr. Merchant said. 
 
 The suit, filed in the Court of Queen’s Bench for Saskatchewan, will also be filed in other jurisdictions and will cover all Canadian customers, Mr. Merchant said. 
 
 In early September, Home Depot acknowledged that its payment system was hit by a security breach, affecting customers in Canada and the United States who used credit and debit cards from April onward. The company said no customer would be responsible for any fraudulent charges on their accounts, and promised it would take aggressive steps to protect customer data going forward. 
 
 The suit alleges Mr. Knuth’s “personal and financial information associated with his credit card was compromised. …as a result of the Home Depot security breach,” although when contacted Thursday he said he doesn’t know yet whether it has been used for nefarious purposes. But he has used his card at Home Depot many times since April, and he is worried about identity theft, unauthorized charges, or that “some day I may do a credit check on myself and find that it’s gone down the toilet.” 
 
 Mr. Merchant said he does not think he will have any trouble getting the class action suit certified in Canada. “The courts are very open to these privacy breach claims,” he said. The amount of the claim has not yet been set. 
 
 Several class action lawsuits have already been filed in the United States on behalf of Home Depot customers. Home Depot spokeswoman Paula Drake said the company hasn’t reviewed any of the suits against it yet. “Our focus is on our customers and our investigation,” she said. Home Depot said Thursday that the “unique, custom-built malware” that hit its computer systems and put 56 million payment cards at risk has now been eliminated. Enhanced encryption has been completed at U.S. stores and will be in Canadian stores by early 2015. 
 
 The Canadian lawsuit alleges Home Depot breached its fiduciary duty to keep personal data confidential, and was negligent in allowing the breach. The company also waited too long to warn customers of the problem, the suit alleges. 
 
 “They weren’t telling people until [security blogger] Brian Krebs broke the story at the beginning of September,” Mr. Merchant said. “An awful lot of people have spent [money] at Home Depot in the last six months, and every one of them is at risk.” 
 
 He noted that in an earlier case against the owners of Winners and HomeSense stores – after a similar data breach – an out-of-court settlement included a payment to all customers as a “worry award.” It also paid back people who had actually suffered financial losses, and reimbursed those who spent money to get extra security for their cards. 
 
 Home Depot has offered free identity theft protection and credit monitoring to any customer who used a payment card at a store since April, but Mr. Merchant said “what they are offering ... is almost nothing and very little in value.” 
 
 Some Canadian customers have also complained that the protection offered in this country is inferior to that offered in the United States. For example, the identity theft insurance in the package offered to Canadians – from credit bureau Equifax – has an upper limit of $50,000. In the United States the insurance in the package from AllClear covers up to $1-million. 
 
 Ms. Drake said the $50,000 maximum is the “best available coverage offered by the [credit] bureaus in Canada.” There are “regulatory and market differences,” between the two countries that account for the contrast, she said. 
 
 Raymond Vankrimpen, head of the risk management practice at Richter Advisory Group Inc. in Toronto, noted that a portion of the $1-million in coverage available to U.S. residents goes to cover legal fees. “Americans are typically more litigious and so the cost of recovering your identity in the U.S. may in fact cost more,” he said. 
 
 Report Typo/Error 

 Shoppers walk through the aisles at a Home Depot store in Williston, Vt., in 2010. The Home Depot said Sept. 18 that it eliminated malware from its U.S. and Canadian networks that affected 56 million payment cards from April to September. (Photo: Toby Talbot, AP) 
 
 Home Depot said Thursday that the security breach it reported this month allowed cyberthieves to cull information from 56 million credit and debit cards, far worse in terms of data loss than a similar attack late last year on the Target store chain. 
 
 The malicious software, or malware, was placed on Home Depot point-of-sale terminals, or cash registers, from April to September, the company said in a news release. The malware was found in Home Depot stores in the USA and Canada. 
 
 The number of cards involved in Home Depot's loss dwarfs the 40 million Target says were compromised over a three-week period. Target said that breach also resulted in the theft of personal data for up to 70 million customers — including names, phone numbers, mailing addresses or email addresses — but the amount of overlap is unknown. 
 
 The Home Depot and Target cases show that big-box retailers are particularly vulnerable to cyberthieves. 
 
 Thieves "are able to invest time in researching their targets to find a way into the network," says Trey Ford, a global security strategist at the security firm Rapid7, in a statement. "Once they're in, they stay quiet and fly unobserved under the radar." 
 
 Brian Krebs, who first broke news of the breach in his KrebsOnSecurity blog, reported that the malware was installed in terminals in self-service aisles, which limited the data loss. Though both credit and debit information was taken, the chain says, the thieves would have been unable to retrieve PIN numbers used on the debit cards. 
 
 Home Depot says the criminals "used unique, custom-built malware to evade detection. The malware had not been seen previously in other attacks," according to Home Depot's security partners. 
 
 The malware has been eliminated, Home Depot said. All infected terminals were taken out of service. Home Depot offers credit monitoring to affected customers. 
 
 The news was announced after the close of trading. Home Depot said the breach has cost $62 million, and that figure could climb in the fourth quarter. Target reported in August that its breach cost $146 million after insurance reimbursements. 
 
 Home Depot shares closed at $92.09, up 87 cents, or 0.95%, on Thursday. 
 
 Home Depot on Monday confirmed a breach of its payment data systems in the United States and Canada. The attack goes back as far as April and appears to have been limited to credit cards. VPC 
 
 Read or Share this story: http://usat.ly/1s9cqXg
– Home Depot released specifics on its security breach today, and it was indeed bigger than the breach at Target: The hardware chain says 56 million credit cards were compromised between April and September at stores in the US and Canada, compared with 40 million in the Target hack, reports USA Today. The respected tech site Krebs on Security reports an interesting twist: Hackers may have hit mostly self-checkout terminals. The report stressed, however, that the investigation isn't complete. Home Depot says that only credit cards were affected, not debit cards, too, and that it has removed the malware used by hackers as well all affected terminals. “We apologize to our customers for the inconvenience and anxiety this has caused, and want to reassure them that they will not be liable for fraudulent charges,” says Home Depot chief Frank Blake in a statement picked up by PC World. Still, shoppers in Canada already have filed a class-action lawsuit against the chain, reports Toronto's Globe and Mail.