Archive — US — techcrunch
Home Depot exposed access to internal systems for a year, says researcher
A Home Depot employee unintentionally published a private access token online, exposing internal systems for a year. Security researcher Ben Zimmermann discovered the breach and reported it to the company, which failed to respond for weeks. Following intervention from TechCrunch, the exposure was fixed. The token allowed access to critical infrastructure, including source code and inventory systems.
Key points
- An employee published a private access token on GitHub, exposing internal systems.
- The exposure lasted approximately one year, beginning in early 2024.
- Researcher Ben Zimmermann discovered the token and tried to notify Home Depot but received no response for several weeks.
- The token provided access to sensitive resources, including source code repositories and cloud infrastructure.
- Home Depot lacks a formal vulnerability disclosure or bug bounty program.
- The exposure was addressed only after TechCrunch contacted Home Depot.
Why it matters
- This incident highlights ongoing cybersecurity challenges for large retailers.
- The case reflects a growing trend of security vulnerabilities arising from mismanagement of access tokens.
- The lack of a vulnerability reporting framework echoes concerns in the industry, especially by 2025, as organizations increasingly prioritize cybersecurity.
The Home Depot incident underscores the necessity of robust security measures and communication strategies in handling potential vulnerabilities to prevent unauthorized access to sensitive internal systems.