Name: Home Depot blunder emails customer order info to strangers
Brand: bleepingcomputer.com
SKU: bleepingcomputer-com-30
Availability: OnlineOnly

critic

Home Depot blunder emails customer order info to strangers

preview

ByToday multiple reports have emerged from Home Depot customers in Canada stating that the company had sent them hundreds of emails containing order information of strangers.Users received upwards of 600 "order ready for pickup" reminder emails and shipment-related notifications, each pertaining to a different order.What alarmed hundreds of users, was the orders were not associated with their Home Depot accounts, and many consider this data leak serious.BleepingComputer has obtained copies of these emails that divulge information such as the customer's name, home address, order number, ordered items, and partial payment card information.A Home Depot Canada customer, Spencer K. Monckton  to the company today:"Hey um... I'm pretty sure I received a reminder email for literally every online order that is currently ready for pick up at literally every Home Depot store in Canada. There are 660+ emails. Something has gone wrong."The order numbers and the information contained within these emails had no relation to Monckton's account.Eventually, more reports surfaced on Twitter showing screenshots and videos of users' flooded mailboxes due to what appeared to be an email system snafu.The emails obtained by BleepingComputer reveal information such as the customer's name, order number along with QR code, pick-up store address—or in some cases the customer's home address, items in the order, and payment receipt containing the last 4 digits of the payment card number.Monckton further told BleepingComputer he had received 467 emails in total between 2:32 AM and 3:29 AM EDT.All emails related to online orders placed between October 24th and 25th, submitted for in-store pickups. The first available pickup day listed on these was Monday (October 26th).The customers, not having picked up the orders lead to the system generating these reminder emails."One of the emails I got was for my own order (the first one, incidentally), but the other 466 were intended for people all across Canada, in both official languages," he said."In the 'To:' line of each email, there were numerous other email addresses listed - up to a maximum of 544. Interestingly, the first email I got included only 83 email addresses, then the next one 84, then 85, then 86, etc. So it seems like the system worked through all the reminders scheduled to be sent, appending each new customer email to a growing list as it went. Hard to say how many customers were likely to be impacted, but you can see from @bethanyfrances' tweet that it wasn't just reminder emails," Monckton told BleepingComputer.Monckton called this quite a "blunder" as according to him, it may be possible for the email recipients to pick up strangers' orders as Home Depot staff may not always ask for identification."In some cases it's possible to match up the first name with an email address from the to line. In theory it's possible to pick up these people's orders using the order number/QR code, since Home Depot doesn't always check ID for customers when they show up for curbside pick-up. Quite a blunder!"To add more misery to an already terrifying situation, the order emails had several customers CC'd on them. This means any customer using the "Reply All" email feature would be responding not only to Home Depot Canada but all the customers who had received the order information in error."This morning I woke up to hundreds of emails from @HomeDepotCanada about picking up orders... Must have some sort of system error. While I thought that was annoying I've realised what is worse is all the people now "replying all" panicking about their orders," tweeted  along with a video of their flooded mailbox.When asked about the incident, Paul Berto, director, corporate communications at The Home Depot Canada told BleepingComputer:"Tuesday evening, we discovered a systems error on select Homedepot.ca orders impacting a small number of our Canadian customers. Some customers may have received multiple emails for orders they did not place.""This issue has been fixed. None of the emails contained passwords or un-hashed payment card information. We apologize for the concern this has caused our customers, and we thank them for their patience and support as we quickly worked through this issue," Berto told BleepingComputer.Home Depot Canada also stepped in on threads they were tagged in, clarifying that the incident had impacted a "very small number" of customers with store pickup orders scheduled.Despite the company's claims, several customers called out Home Depot for the "VERY serious data breach" and refuted that this had impacted only a few customers:bethanyfrances' concern has merit to it considering her private information, including  and partial payment card information was leaked to hundreds of strangers CC'd in the email she had received from Home Depot.The user further  she was reporting the major data breach to Canada Privacy Commissioner and encouraged others to follow their lead.While the incident did not expose overly sensitive information such as complete payment card data or user passwords, it is still a serious privacy breach.Receiving not a few—but hundreds of emails with full names, home addresses, email addresses, partial payment card numbers, and order info of random strangers would ring anyone's alarm bells.In 2014, Home Depot had experienced a  that compromised credit card details of 56 million users.Update, Oct 29th 2020: clarified that customers' home addresses were also exposed to strangers by incorporating bethanyfrances' tweet.Ax Sharma is a Security Researcher, Engineer, and Tech Columnist. His works and expert analyses have frequently been featured by leading media outlets like Fortune, The Register, TechRepublic, CIO, etc. Ax's expertise lies in vulnerability research, reverse engineering, software development, and web app security. He's an active community member of the OWASP Foundation and the British Association of Journalists (BAJ).Send any tips via email or Twitter DM.Post a CommentYou need to login in order to post a commentNot a member yet?:  —  Discover, assess, prioritize, and patch critical vulnerabilities in real time and across your global hybrid-IT landscape all from a single solution.:  —  Custom testing designed to help you fight back against attackers targeting your organization.Popular StoriesTo receive periodic updates and news from , please use the form below.Latest DownloadsHelp us understand the problem. What is going on with this comment?Submitting...

ByToday multiple reports have emerged from Home Depot customers in Canada stating that the company had sent them hundreds of emails containing order information of strangers.Users received upwards of 600 "order ready for pickup" reminder emails and shipment-related notifications, each pertaining to a different order.What alarmed hundreds of users, was the orders were not associated with their Home Depot accounts, and many consider this data leak serious.BleepingComputer has obtained copies of these emails that divulge information such as the customer's name, home address, order number,...

Home Depot blunder emails customer order info to strangers

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS