Home Depot settles 2014 data-breach case

The Atlanta-based Home Depot has agreed with 46 states and the District of Columbia to payout $17.5 million -- to be shared among the states -- to settle a 2014 data breach case.

According to various announcements from the states, the breach involved payment card information of some 40 million consumers around the country.  

The breach occurred when hackers gained access to The Home Depot’s network and deployed malware on The Home Depot’s self-checkout point-of-sale system, according to the states. The malware allowed the hackers to obtain the payment card information of customers who used self-checkout lanes at Home Depot stores throughout the U.S. between April 10, 2014 and Sept. 13, 2014.

In addition to the $17.5 million total payment to the states, The Home Depot has agreed to implement and maintain a series of data security practices designed to strengthen its information security program and safeguard the personal information of consumers, according to the announcement from various states.

A statement from Georgia's Attorney General Chris Carr included: "We believe The Home Depot has been proactive in correcting this situation by taking the necessary measures to address the issue at hand."

Payouts to the 45 states and District of Columbia vary.  The state of Georgia will collect $356,366.24 through this settlement. Montana gets $95,831. 

The settlement also includes the following actions from the Atlanta-based retail giant:

• Employing a duly qualified Chief Information Security Officer reporting to both the Senior or C-level executives and Board of Directors regarding Home Depot’s security posture and security risks;

• Providing resources necessary to fully implement the company’s information security program;

• Providing appropriate security awareness and privacy training to all personnel who have access to the company’s network or responsibility for U.S. consumers’’ personal information;

• Employing specific security safeguards with respect to logging and monitoring, access controls, password management, two factor authentication, file integrity monitoring, firewalls, encryption, risk assessments, penetration testing, intrusion detection, and vendor account management; and

• Consistent with previous state data breach settlements, the company will undergo a post settlement information security assessment which in part will evaluate its implementation of the agreed upon information security program.

The states that did not participate in the settlement are Alabama, New Hampshire, South Dakota, and Wyoming.