States announce settlement with Home Depot over breach

Attorneys general from 47 states Tuesday announced a $17.5 million joint settlement with Home Depot, resolving a multistate investigation into a 2014 data breach that exposed the payment card information of approximately 40 million Home Depot customers across the nation. Nevada will receive $150,712.30 from the settlement.

The breach occurred when hackers gained access to the Home Depot’s network and deployed malware on the company’s self-checkout point-of-sale system. The malware allowed the hackers to obtain the payment card information of customers who used self-checkout lanes at Home Depot stores throughout the United States between April 10 and Sept 13, 2014.

“My office continues to focus on data security and consumer privacy,” Nevada Attorney General Aaron Ford said. “Investigations like this one produce meaningful settlements that set a high floor for the data security standards we expect from companies that handle the personal information of our consumers.”

In addition to the settlement payment, Home Depot has agreed to implement and maintain a series of data security practices designed to strengthen its information security program and safeguard the personal information of consumers.

Home Depot agreed to employing a duly qualified chief information security officer who will report to both the senior or C-level executives and board of directors regarding the company’s security posture and security risks, and it will provide resources necessary to fully implement the company’s information security program.

Also, the company agreed to provide appropriate security awareness and privacy training to all personnel who have access to the company’s network or responsibility for United States consumers’ personal information, and employ specific security safeguards with respect to access controls, password management, two-factor authentication, firewalls, encryption, risk assessments, penetration testing and vendor account management.

Consistent with previous state data breach settlements, the company’s implementation of the security program will be evaluated through a post settlement information security assessment.

In addition to Nevada, the settlement included the attorneys general of Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, the District of Columbia, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia and Wisconsin.