News release: “The Home Depot®, the world’s largest home improvement retailer, today disclosed additional findings related to the recent breach of its payment data systems. The findings are the result of weeks of investigation by The Home Depot, in cooperation with law enforcement and the company’s third-party IT security experts. Additional Investigation Details Disclosed – In addition to details previously released, the investigation to date has determined the following: Criminals used a third-party vendor’s user name and password to enter the perimeter of Home Depot’s network. These stolen credentials alone did not provide direct access to the company’s point-of-sale devices.  The hackers then acquired elevated rights that allowed them to navigate portions of Home Depot’s network and to deploy unique, custom-built malware on its self-checkout systems in the U.S. and Canada.  In addition to the previously disclosed payment card data, separate files containing approximately 53 million email addresses were also taken during the breach [emphasis added]. These files did not contain passwords, payment card information or other sensitive personal information. The company is notifying affected customers in the U.S. and Canada. Customers should be on guard against phishing scams, which are designed to trick customers into providing personal information in response to phony emails. Information about how to avoid phishing and other email scams is available by typing https://www.onguardonline.gov/articles/0003-phishing into your web browser. As previously disclosed, the malware used in the attack had not been seen in any prior attacks and was designed to evade detection by antivirus software, according to Home Depot’s security partners. As the company announced on September 18, the hackers’ method of entry has been closed off and the malware has been eliminated from the company’s systems. The Home Depot’s investigation, cooperation with law enforcement and efforts to further enhance its security measures are ongoing. The company does not anticipate further updates on the breach outside of its quarterly financial disclosures. The Home Depot continues to offer free identity protection services, including credit monitoring, to any customer who used a payment card at a Home Depot store in 2014, from April on. Customers who wish to take advantage of these services can learn more at www.homedepot.com or by calling 1-800-HOMEDEPOT (800-466-3337). Customers in Canada can call 800-668-2266.”