CONTACT: Charity R. Clark, Chief of Staff, 802-828-3171
Attorney General T.J. Donovan today announced that Georgia-based retailer The Home Depot, Inc. will pay the State of Vermont $354,000 as part of a $17.5M settlement with a coalition of attorneys general of 45 other states and the District of Columbia. The settlement announced today resolves a multistate investigation of a 2014 data breach that exposed the payment card information of approximately 40 million Home Depot consumers nationwide. In addition to the $17.5M payment to the states, Home Depot has agreed to implement and maintain a series of data security practices designed to strengthen its information security program and safeguard the personal information of consumers.
“Today’s settlement resolves a long-running investigation and establishes procedures for the Home Depot to protect its customers’ sensitive information going forward,” said Attorney General Donovan. “Consumers deserve to know that businesses are using proper data security measures. When businesses fail to protect their consumers’ sensitive information, we will hold them accountable.”
According to the multistate investigation, the data breach occurred when hackers gained access to Home Depot’s network and deployed malware on Home Depot’s self-checkout point-of-sale system. The malware allowed hackers to obtain the payment card information of customers who used self-checkout lanes at Home Depot stores throughout the U.S. between April 10, 2014 and September 13, 2014.
In addition to the $17.5 million total payment to the states, Home Depot has agreed to implement and maintain a series of data security practices designed to strengthen its information security program and safeguard the personal information of consumers. Specific security provisions agreed to in the settlement include:
- Employing a duly qualified Chief Information Security Officer reporting to both the Senior or C-level executives and Board of Directors regarding Home Depot’s security posture and security risks;
- Providing resources necessary to fully implement the company’s information security program;
- Providing appropriate security awareness and privacy training to all personnel who have access to the company’s network or responsibility for U.S. consumers’ personal information;
- Employing specific security safeguards with respect to logging and monitoring, access controls, password management, two-factor authentication, file integrity monitoring, firewalls, encryption, risk assessments, penetration testing, intrusion detection, and vendor account management; and
- Home Depot will undergo a post-settlement information security assessment, which, in part, will evaluate its implementation of the agreed upon information security program.
Joining Attorney General Donovan in this settlement are the attorneys general of Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, District of Columbia, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Virginia, Washington, West Virginia, and Wisconsin.
A copy of the settlement can be found here.