National retailer HomeGoods Plus has confirmed a point-of-sale system breach affecting 420 store locations across 32 states. Payment card data including card numbers, expiration dates, and CVV codes were compromised during a six-week window from February 28 through April 10.
The company's investigation revealed that attackers deployed memory-scraping malware on POS terminals through a compromised software update server. The malicious update was digitally signed using a stolen code-signing certificate, allowing it to bypass endpoint security controls.
