How Home Depot CEO Frank Blake kept his legacy from being hacked

So no one complained when Blake decided to spend the weekend at his second home in Sea Island, Ga., with his family. (Of course, holiday or no holiday, he still showed up in his Atlanta office on Labor Day to do what he usually does on Sundays: read emails and handwrite some 200 notes to top-performing employees.)

It’s a good thing he had the break: The next morning, at about 9:20, Home Depot’s general counsel, Teresa Roseborough, called Blake with the type of message every executive dreads. It appeared that the company’s computer systems had been infiltrated. Home Depot (HD) would soon discover that some 56 million credit card numbers had been exposed to hackers. Not only was it a potentially devastating blow for the company, but it was also a last-second black mark on a nearly unblemished executive tenure.

So how did Blake react? Let’s start by thinking about what he could have done. He easily could have handed off the problem to his successor. After all, Blake had already announced the transition—why not let the new guy earn his stripes? He could have clammed up, afraid that any admission of guilt would tarnish his reputation and leave Home Depot more vulnerable to the lawsuits that had already begun to pour in. He could have placed the blame on the foreign hackers themselves, or on the U.S. government, or argued that it happened to everyone (which it lately has seemed to), or publicly guillotined the executives who had failed to keep the intruders out.

Blake didn’t do any of that. Instead, he acted the same way he has acted for the past seven-plus years when faced with a challenge: He took full responsibility, empowered his team to fix the problem, and kept the focus where it needed to be, squarely on the customer. Within a few hours of that initial phone call, the company apologized to its customers in a statement—mercifully free of mealy-mouthed corporate jargon—on its website and assured them that they would not be liable for any fraudulent charges. “We know these types of incidents can cause frustration and concern,” the statement read, “and we apologize for that.” Five days later another apology came, this one from Blake personally.

Says the usually crusty Langone of Blake: “He is one of the finest human beings I have ever been blessed to know.”

Rather than put Menear on the hot seat, Blake took charge of the breach response. He backed up his chief information officer, Matt Carey, and spent time in the “incident response” room set up on the 20th floor of Home Depot headquarters. Meanwhile Blake empowered Menear to begin taking the operational reins of the company. And the blame? Well, Blake took that on too. “I made a lot of mistakes before this,” he says today, with characteristic modesty, “but this may have been a more visible one.”

The breach was, unquestionably, a disaster. It revealed a vulnerability deep at the heart of one of America’s most important retailers, and it’s still not clear what impact, if any, it will have on the company’s results. Yet Blake’s response to the breakdown matches his approach to running Home Depot—an approach few foresaw when the board abruptly named him to replace Bob Nardelli in 2007. He tackled the hack with the same forthrightness, humor, and humility that he has displayed in reviving Home Depot.

“Humility” is a term seemingly better suited to monks and yogis than to chief executives or corporate lawyers (yes, that’s Blake’s background). But it is the single word that comes up most often when people characterize both Blake and the culture he has nurtured, as months of exclusive interviews with Blake and his team reveal. Ken Langone, one of the company’s billionaire co-founders and a crusty sort better known for excoriating executives than sanctifying them, turns almost misty-eyed when asked about Blake. “The thing that always impressed me was his sincere humility,” Langone says. “He is one of the finest human beings I’ve ever been blessed to know in all of my life.” Frank Blake never intended to be a chief executive. But what he learned while being one—and while preparing not to be one any longer—makes for one heck of a case study.

Blake has often called himself “the accidental CEO.” That was painfully apparent on his first day in the position, Jan. 3, 2007, when he appeared on a broadcast to Home Depot’s then-364,000 associates. As he introduced himself, sitting stiffly behind a table with the company’s top store execs, all of them wearing the company’s trademark orange aprons, Blake looked positively terrified.

Who could blame the guy? Sure, he had a gleaming résumé: Blake had been a law clerk for Supreme Court Justice John Paul Stevens, and he was a former deputy secretary of energy. But the closest he’d ever come to overseeing a P&L was a tiny licensing business at General Electric, where he had worked years before Nardelli brought him to Home Depot as head of strategy and new-business development. (Blake was eventually promoted to vice chairman.) Now he was at the helm of a company with $79 billion in revenue—an enterprise suffering from declining same-store sales, a stock price swooning in tandem with the housing downturn, and misery in the ranks.

Blake seemed the antithesis of Nardelli, an autocratic former GE executive who slashed spending, boosted earnings, was paid a king’s ransom—his severance package was then valued at a jaw-dropping $210 million—and managed to alienate investors, the board, and employees. That was precisely the point. The world viewed Blake’s ascension as a move to placate activist investors. Even Blake’s son, at the time a 30-year-old Home Depot store manager with much more experience running a business than his dad, was incredulous when he heard the news. “I said, ‘Okay…good luck,’” remembers Frank Stanton Blake. “I had all the faith in the world, but I still felt like it would be a massive undertaking.”

What Blake laid out on his first day as CEO was a strategy that he has not deviated from since—all the more remarkable when you consider just how inexperienced he was. He said then, in a none-too-subtle rebuke to Nardelli, that Home Depot needed to return to its focus on customers and employees (known at the company as “associates”). Only if that happened would success follow. He said that he would try to “create an environment where people are free to say what they think. I will be doing a lot of listening.”

Less than a week later, in his second broadcast, on Jan. 8, Blake had his leadership model worked out—“the inverted pyramid,” a simple upside-down triangle that he borrowed from the company’s co-founders, Bernie Marcus and Arthur Blank. It put the frontline store associate on top and the management team on the lowest level. “The right way to look at this is me on the bottom,” he said. “My job here is to clear away the things that get in your way.”

It’s easy, of course, to spout management platitudes. But Blake, an unassuming, cerebral type whose wife once called his public-speaking style “appalling”—he’s only slightly less wooden than the two-by-fours in aisle six—proceeded to do exactly what he said. “Clearing away the things that get in your way” meant making hard decisions. Blake sold off many of the acquisitions that he had helped put together under Nardelli and took a $162 million charge to close the company’s seven stores in China because, as he admitted, he couldn’t figure out the market. Blake changed the bonus system for store associates to emphasize customer service and dramatically increased the bonus pool, even though earnings were collapsing during the recession. (The pool jumped from $36 million in 2006 to $250 million in 2013 for roughly the same number of associates.)

Most of all, Blake got a fractured executive team to row in the same direction, says Carol Tomé, Home Depot’s highly respected longtime CFO. He achieved that unity in an unusual way. “He invited conflict into our decision-making,” she says, noting that under Nardelli people were afraid to share problems. “We were conflict-hesitant. Frank asks a ton of questions that make you say what is working and not working.”

“There is a part of the succession process that is harsher than it should be,” Blake says wistfully.”

For example, Blake flew to Dallas in 2008 when a new distribution center, opened as part of a strategy to centralize purchasing, wasn’t ready for the volume it needed to handle. Other CEOs, says Mark Holifield, executive vice president for supply-chain and global sourcing, might have barked at their lieutenants to fix the problem or even abandoned the entire strategy. But Blake appeared on the scene, asked endless questions, traveled with his executives to another distribution center in Chicago, decided that the problem could be fixed, and then told his team he was confident they would fix it. Holifield laughingly describes the CEO as “urgently patient” during the episode.

What Blake lacked in experience, he made up for by listening. “How do you make people comfortable enough to tell you what they don’t want to tell you?” Blake asks. “If you actually want to know, you have to sit around with them and say, ‘I know this is going really badly…’ Usually they say, ‘Oh, my gosh, he knows it’s going badly.’ They really don’t think you care.”

Blake applied his listening far beyond plush corporate suites. Throughout his tenure he spent one to two days a week walking the floor at various Home Depot stores, both to understand products and to figure out how the associates work and what they need. Blake isn’t the type who has a circular saw in his garage—he’s the Harvard-educated son of a finance executive—but he learned the needs of his customers. Says Home Depot co-founder Marcus: “The first time I walked the store with him, he really knew nothing. The last time he knew as much as I ever did. He became a merchant.”

In seven years Blake has strode through the aisles 1,000 times—more than the founders did in their more than 20 years at Home Depot. He picks crumbs up off the floor and tweets photographs (notably not selfies) of top associates on his personal account. He has made managers feel that they are there to help customers solve problems rather than to push product. “The only way people know what you want,” Blake says he has learned over time, “is that you celebrate when they get it right. I am a lawyer. Lawyers don’t celebrate shit.”

In an era in which you can buy almost anything online, he recognizes that there has to be a reason to come to a Home Depot—and that reason is service. The results show: In the company’s “voice of the customer” surveys, the net percentage who would strongly recommend Home Depot to others has increased 44% during Blake’s tenure. Employee confidence in customer service has gone up 95% during the same period.

Blake admits that he enjoyed one secret advantage: his son, who made it easy for the CEO to wander the aisles without fanfare whenever he wanted—they often hung out together in his store on weekends—and also told him when a particular message or initiative was falling flat. “I would always give him candid and unbiased feedback,” the younger Blake says. When his region was hit by severe storms, he told his father that the goods people needed were not arriving in stores fast enough. The observation led to changes in the company’s overall supply chain. When asked what it was like to have his dad become his boss, the son laughs. “Everybody’s got to play the hand they are dealt,” he says. “But I realized that if the worst thing that happened to me was that customers got to know my dad, we’d be just fine.”

“Assessments of the nature of the threat weren’t sufficient,” Blake says of the massive data breach.

It’s easy to forget now that the Blake era did not begin well. For nearly the first three years of his tenure, same-store sales, wrecked by the recession and by improvements at rival Lowe’s, swooned. Home Depot’s stock collapsed from $41 when he started to a low of $18 in March 2009. But the devastation helped Blake in some ways by giving him the latitude to make difficult, costly choices—such as pulling out of the professional-contractor business that Nardelli had championed—without investors passing judgment. “To resist the temptation of what the market wants to hear is very difficult,” says David Schick, a managing director at Stifel. “The Frank Blake school of management was do the right thing, boil everything down and keep it simple, and make the hard decision without kicking the can down the road.”

Even as the housing market remained in disarray, Blake’s changes began to pay off. In the second quarter of 2009 the company beat Lowe’s in same-store-sales performance (in this case, the numbers declined less than its rival’s) for the first time in 21 quarters, leading to a winning streak that has itself lasted for 21 quarters. Last year the company increased its sales by nearly $5 billion without the crutch of adding new stores. It’s an amazing accomplishment at a time when almost all other big-box retailers are struggling—and a testament to Peter Drucker’s famous adage that “culture eats strategy for breakfast.”

In part because of the turbulence of his own accession, Blake focused on succession planning from the start, bringing it up at his very first board meeting. “I would have taken it as a big personal failure if we hadn’t promoted from within,” he says. He also wanted to avoid the kind of chest-pounding that he had witnessed at places like General Electric, where Jack Welch named three potential successors—one of whom was Nardelli—and openly encouraged them to compete against one another in a process that became a distraction.

Even before Blake took over, Home Depot had a particularly engaged board: Directors were required to go on two store walks a year. But in 2011 the board decided that each director would be assigned to spend a day with one member of the senior management team every quarter. The two would visit stores and assess them—in part to help directors understand them and in part so that they could see high-potential candidates in action. Over time, all the directors would get to know the top management team personally. Under Blake the board devoted first one and then, about three years ago, two meetings a year specifically to talent reviews and succession planning.

So when Blake began to contemplate retirement in 2013, he and the board resolved to create a process that was as humane as possible. Says Greg Brenneman, lead director and former CEO of Burger King: “Our goal was to go through that in a place that maintained the dignity and respect” of the contenders. Home Depot had identified three potential successors: Menear, Tomé, and Marvin Ellison, the head of stores. All three insist that in contrast to GE’s fractious competition, the Home Depot process was predicated on cooperation among the contenders. Says Ellison: “He encouraged all of us to just continue to do what’s most important. It never really turned into a competition where we were making presentations to the board or putting on dog-and-pony shows.”

In February, Menear was named president of the company’s U.S. retail division, signaling that the CEO job would be his to lose. There was no rancor, and Blake is confident in his choice. Still, he seems wistful. “There is a part of the succession process that is harsher than it should be,” Blake says, “in the sense of really, really gifted leaders who in the end feel less appreciated than they should.”

When I read his comments to Tomé, she pauses, visibly touched. “What other environment could you ask for instead of one of candor?” she asks. “We are grownups and understand one person is selected, and you move on.” Despite losing out on the top spot, Tomé retains her affection for Blake and rues his departure. “I am in mourning,” she says. “I would do anything for Frank, anything he asked.”

For his part, Ellison has moved on; he was named CEO-designate of J.C. Penney in October. Blake’s reaction to the news was telling. Rather than a frosty or formal goodbye, Blake instead gave him a warm and humorous sendoff. He offered a seemingly heartfelt tribute to the history of J.C. Penney in which he inserted a fake quote from founder James Cash Penney to the effect that the department store “should not be in the windows or the blinds business” (which happens to be the one area in which it overlaps with Home Depot). Blake ribbed Ellison about his style—he favors cufflinks and sports coats in a place where rumpled khakis are the norm—by giving him cowboy boots, a 10-gallon hat (the company is based in Texas), and a pair of Penney’s Arizona-brand jeans. “Those were my parting gifts,” says Ellison, laughing. “That is his way.”

Ellison will be tackling a notoriously difficult challenge at Penney, but in one respect he’ll have a leg up on Menear: He won’t have to follow a legend. Craig Menear will have to spend much of his early tenure being perceived as “not Frank Blake,” who not only was loved and respected but also presided over a 127% increase in the company’s share price.

Menear, 57, knows the pressure is on, as it was on Tim Cook at Apple and Robert McDonald at P&G, each of whom succeeded iconic CEOs. “Nobody is going to replace Frank,” he says. “He is unique. I just have to be me, and the question is, How do I continue to nurture what Frank started?”

It helps that Menear is a familiar face, and one who has earned a superb reputation of his own. A native of Flint, Mich., Menear has spent his career in retail, starting as a trainee at Montgomery Ward, later moving to Stør, an Ikea knockoff, and then launching his own baby-products business before joining Home Depot in 1997 in the Southwest merchandising operation. He moved up quickly, eventually taking charge of the company’s massive supply-chain reinvention and its online retailing. “He has this global view of where Home Depot needs to be in the future,” says co-founder Marcus, “and he is a merchant.”

Menear is, in fact, the first merchant to run the company since Marcus. His office is dominated by framed photographs of tools, such as Ryobi drills and a Porter-Cable compressor/nail-gun combo kit. When discussing them, Menear lights up like one of the company’s LED products. “That unit was huge. It brought in tens of millions of dollars,” he says of the compressor. “I’m pretty proud.” Menear is a true customer. He recently built new closets and installed light fixtures in his home.

Menear must also find a way to deal with the fact that the Home Depot band is breaking up after many years. He has already found a replacement for Ellison, but then there’s the question of Tomé, who remains but is certainly on the shortlist for other CEO jobs, should she decide to pursue them. “I am here now,” she says, noting that she has known she wouldn’t get the top job since February.

Then, of course, there is the matter of the security breach. Although no one would wish a giant security problem on anyone, the emergency probably helped Menear step into Blake’s shoes more quickly, as the board decided that Menear would focus on day-to-day operations and long-term strategy while Blake dealt with the crisis. “You would never want this,” says Brenneman, “but in a funny way, that sort of awkward period that happens after you’ve been named went away the day that breach happened.”

It’s fair to blame Blake for allowing the hackers to penetrate Home Depot. The company’s information technology division reported to him, after all. That said, Blake was slow rather than oblivious. After an attack on Target in December 2013 led to the theft of data for 40 million customer credit cards, Blake and his team gathered to figure out how to avoid a similar disaster.

Home Depot assembled an “incident response team” and went through a five-hour review with the audit committee in August as well as a discussion with the entire board. It planned a more secure system for processing payments. But even as those talks were happening, malware had already made its way inside the company’s servers. “Clearly,” says Brian Krebs, the cybersecurity blogger who first reported the problem, “Home Depot did not perceive the threat was imminent.”

Some former executives have asserted that Home Depot hoped to save money and did not upgrade its systems when it should have. Blake denies that and says that spending would not have made a difference. “It’s like saying you didn’t reinforce the plate glass window at the bank,” he says. “But this wasn’t a rock through the window.” That said, he admits to having failed in a broader sense. “If you rerun the tape,” Blake says, “there are assumptions we made and assessments of the nature of the threat that in retrospect weren’t sufficient.”

Where Blake and his team excelled, however, was in responding to the discovery of the breach. Even before they had confirmed that there was indeed an incursion, customers were offered free credit-monitoring systems. To make sure nobody was left on hold with questions, the company rented a call center capable of handling 50,000 calls a day (volume never exceeded 25% of capacity, but Blake preferred to be safe). Within two weeks of the news the company announced that it had installed enhanced encryption systems in its U.S. operations. (One wonders why, if such steps are so easy to implement, they weren’t put in place earlier.) Total costs of the breach are estimated at $62 million so far.

None of that may make much difference, given the fact that many hackers, particularly those overseas, can operate with almost no fear of being caught. Kevin Mandia, COO of FireEye, points out that similar incidents are happening almost every day: Since Home Depot’s announcement, J.P. Morgan Chase, Kmart, and others have reported their own breaches. “To me,” he says, “if there’s no risk of repercussions to people doing these acts, and there are none at the end of the day, you’re going to get sucker-punched.”

Experts such as George Grachis, information systems security manager at Satcom Direct, a provider of satellite communication services, say they’re glad to see Home Depot’s response. But Grachis says the only path is to shift from complying with broad security standards, which are already out of date, to assuming that hackers are already in your system and enhancing the monitoring technologies that will find them more quickly. “Compliance is backward-looking and static,” Grachis says. “Security is forward-looking, dynamic, and intelligent.”

For all the panic that rippled through Home Depot on Sept. 2, to this point the repercussions for the company—and for Blake’s reputation—don’t seem dire. Unlike Target, which saw sales fall after the hack, Home Depot has shown no public signs of a decline. That is in part because it was the first of several hacking episodes to occur in rapid succession. But it is also because of Blake’s forthright approach. “Zero percent of this should affect his legacy,” says Langone.

No one would be upset if Blake had wanted to stick around as chairman for a while, particularly after the breach. But he says he intends to leave within a few months. He knows how easy it is to keep looking to the former CEO for guidance if that person remains on the board. He wants to get out of the way.

And then what? Blake says he doesn’t know. (His wife, the general counsel at Habitat for Humanity, has also just retired.) “This is going to be scary,” he says. “I’ve never, ever had an empty work period. Holy crap!” He has spent more than seven years excelling, in part because he was so good at listening to others. Now he’ll need to get comfortable listening to himself.

WATCH: How Home Depot got ahead of its cyberattack

This story appears in the November 17, 2014 issue of Fortune.