Today, multiple reports have emerged from Home Depot Canada customers stating that the company has sent them hundreds of emails containing order information from unknown individuals.
Users received over 600 order reminder emails ready for pickup and shipping-related notifications. Each email related to a different order.
What worried hundreds of users was that the orders were not associated with their Home Depot accounts, and many consider the leak serious.
BleepingComputer obtained copies of these emails that reveal information such as the customer's name, home address , order number, items ordered, and payment card information .
Mailboxes were flooded with order receipt emails
A Home Depot Canada customer, Spencer K. Monckton posted a tweet today, addressing the company:
“Hi… I’m sure I received a reminder email for literally every online order that is currently ready for pickup at literally every Home Depot store in Canada. I received over 660 emails. Something went wrong.”
The order numbers and information contained in these messages had nothing to do with Monckton's account
Ultimately, most reports appeared on Twitter showing screenshots and videos of users' mailboxes being flooded.
The emails received by BleepingComputer reveal information such as the customer's name, order number along with QR code , pickup store address – or in some cases the customer 's home address , order details, and payment receipt containing the last 4 digits of the credit/debit card number.
Monckton further told BleepingComputer that he had received 467 emails in total between 2:32 a.m. and 3:29 a.m. EDT.
All emails related to online orders placed between October 24th and 25th were submitted for in- store with the first available pickup day listed as Monday (October 26th).
“One of the emails I received was for my own order, but the other 466 were for people across Canada,” he said.
Monckton called it a terrible "mistake," as according to him, it's possible for recipients of the emails to pick up orders from strangers, as Home Depot staff may not always ask for identification upon pickup.
Reply-All and “CC” have made users even more upset
This means that any customer who uses the email's "Reply All" feature will not only reply to Home Depot Canada but also to all other customers who were in the same conversation.
