Home Depot Home Improvement Retailer Breach (Salesforce, 2025): 10.5 Million Customer Contact Records Exposed

About HomeDepot

Home Depot is the largest home improvement retailer in the United States, operating more than 2,300 stores across North America alongside a major e-commerce platform. The company is publicly traded on the NYSE and headquartered in Atlanta. It serves both consumer and professional contractor customers with products spanning building materials, tools, appliances, garden supplies, and home finishing goods.

Why They Hold Your Data

Home improvement retailers collect customer identity, contact details, addresses, payment-adjacent data, order history, loyalty records, and contractor-linked transactions across retail systems.

Recent Developments

Home Depot has focused on its professional customer segment as a key growth driver, investing in supply chain improvements and digital tools for contractors and trade professionals. The company acquired SRS Distribution, a specialty distributor serving roofing and landscaping trades, in 2024 for approximately $18.25 billion — its largest acquisition. Leadership has maintained focus on the Pro and online segments to offset softer consumer DIY demand.

Data Points Exposed

Breach Impact

Home Depot was among the approximately 39 organizations listed on the Scattered LAPSUS$ Hunters dark web leak site in October 2025. Security researchers noted the Home Depot dataset was particularly sensitive because it contained a file segment dedicated to government employees, including names, email addresses, postal addresses, and phone numbers. Some records appeared to include personal home addresses rather than work addresses, creating targeted risk for federal, state, and county workers whose identities and locations were exposed alongside their government affiliation. Home Depot has not made detailed public statements about its specific response to this campaign.

Exploitation & Downstream Threats

• SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
2. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
3. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).