November 24, 2020 - Herring Secures $17.5 Million Settlement with Home Depot over Data Breach

~ 2014 data breach exposed payment card information of 40 million consumers nationwide; Virginia to receive nearly $300,000 as its share of the settlement ~

RICHMOND (November 24, 2020) – Attorney General Mark R. Herring has secured a $17.5 million settlement with Georgia-based retailer The Home Depot, resolving a multistate investigation of a 2014 data breach which exposed the payment card information of approximately 40 million Home Depot consumers nationwide. Attorney General Herring joins a bipartisan coalition of 47 attorneys general in securing this settlement. Under the terms of the agreement, The Home Depot will pay Virginia $299,561.60.

“Businesses that collect or maintain sensitive personal information have a heightened duty to keep that information secure,” Attorney General Herring said. “These companies must make it a top priority to implement and adhere to reasonable practices and procedures that will protect consumers’ information from bad actors. My team and I will continue to make sure that businesses do not fall short of their obligation to protect their consumers' private information.”

The breach occurred when hackers gained access to The Home Depot’s network and deployed malware on The Home Depot’s self-checkout point-of-sale system. The malware allowed the hackers to obtain the payment card information of customers who used self-checkout lanes at The Home Depot stores throughout the U.S. between April 10, 2014 and Sept 13, 2014.

In addition to the $17.5 million total payment to the states, The Home Depot has agreed to implement and maintain a series of data security practices designed to strengthen its information security program and safeguard the personal information of consumers.

Under the settlement, the Home Depot agrees to implement the following information security measures:

• Employ a duly qualified Chief Information Security Officer reporting to both the Senior or C-level executives and Board of Directors regarding Home Depot’s security posture and security risks;
• Provide resources necessary to fully implement the company’s information security program;
• Provide appropriate security awareness and privacy training to all personnel who have access to the company’s network or responsibility for U.S. consumers’ personal information;
• Employ specific security safeguards with respect to logging and monitoring, access controls, password management, two factor authentication, file integrity monitoring, firewalls, encryption, risk assessments, penetration testing, intrusion detection, and vendor account management; and
• Consistent with previous state data breach settlements, the company will undergo a post settlement information security assessment which in part will evaluate its implementation of the agreed upon information security program.

Virginia’s settlement is in the form of an Assurance of Voluntary Compliance, which has been filed for approval with the Henrico County Circuit Court.

Joining Attorney General Herring in today’s settlement are the attorneys general of Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, District of Columbia, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Washington, West Virginia, and Wisconsin. 

# # #