Hartford, CT— Attorney General William Tong announced that Connecticut, along with the attorneys general of 45 other states and the District of Columbia, has obtained a $17.5 million settlement against Georgia-based retailer The Home Depot, resolving a multistate investigation into the 2014 data breach which exposed the payment card information of approximately 40 million Home Depot customers nationwide. The State of Connecticut will collect $1,093,196.25 through this settlement.
The breach occurred when hackers gained access to the Home Depot network and deployed malware on Home Depot’s point-of-sale system. The malware allowed the hackers to obtain the payment card information of customers who used self-checkout lanes at Home Depot stores throughout the U.S. between April 10 and September 13, 2014.
In addition to the $17.5 million total payment to the states, Home Depot has agreed to implement and maintain a series of data security practices designed to strengthen its information security program and safeguard the personal information of consumers.
“Companies like Home Depot who collect sensitive personal information from their customers have an obligation to protect that information from unlawful use or disclosure. Home Depot failed to take those precautions, and as a result exposed the payment card information of 40 million of their customers. Connecticut co-led this investigation and settlement, and will continue to lead the nation in enforcing rigorous compliance with state consumer privacy laws,” said Attorney General Tong.
Under the settlement, Home Depot has agreed to a number of specific information security provisions. Those include:
• Employing a duly qualified Chief Information Security Officer reporting to both Senior or C-level executives and Board of Directors regarding Home Depot’s security posture and security risks;
• Providing resources necessary to fully implement the company’s information security program;
• Providing appropriate security awareness and privacy training to all personnel who have access to the company’s network or responsibility for U.S. consumers’ personal information;
• Employing specific security safeguards with respect to logging and monitoring, access controls, password management, two factor authentication, file integrity monitoring, firewalls, encryption, risk assessments, penetration testing, intrusion detection, and vendor account management; and
• Consistent with previous state data breach settlements, the company will undergo a post-settlement information security assessment which in part will evaluate its implementation of the agreed upon information security program.
Connecticut co-led the multistate investigation with Texas and Illinois, assisted by California, Florida, Indiana, Massachusetts, New Jersey, North Carolina, Ohio, Pennsylvania, and Vermont, and joined by Alaska, Arizona, Arkansas, Colorado, Delaware, District of Columbia, Georgia, Hawaii, Idaho, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Mexico, New York, North Dakota, Oklahoma, Oregon, Rhode Island, South Carolina, Tennessee, Utah, Virginia, Washington, West Virginia, and Wisconsin.
Separate from today’s multistate settlement, Home Depot previously offered one year of post-breach credit monitoring to impacted consumers. Under a class action settlement unrelated to today’s multistate action, Home Depot established a $13 million fund to allow for payments to consumers who have documented losses caused by the breach, as well as an additional 18 months of credit monitoring for those who enrolled. Although the claims filing period has closed, information about that class action suit can be found here: http://www.homedepotbreachsettlement.com. The claims period for the class action ended in 2016.
The Connecticut Office of the Attorney General was among the first across the country to form a dedicated Privacy and Data Security Department. The protection of consumer privacy and data security continues to be a top priority of the Office. Recently, Connecticut led a $39.5 million multistate settlement with Anthem stemming from the massive 2014 data breach, and co-led the multistate investigation into the 2017 Equifax data breach that culminated in a $600 million settlement with the company last year — the largest data breach settlement in history. Prior to that, Connecticut also co-led the multistate investigations into data breaches at Uber and Target. As with Equifax, those investigations shed light on widespread data safeguarding failures and yielded historic settlements. Attorney General Tong serves as co-chairman of the National Association of Attorneys General Internet Safety/Cyber Privacy and Security Committee.
Assistant attorneys general Michele Lucan, John Neumon, Áine DeMeo, and Jeremy Pearlman, Head of the Privacy and Data Security Department, assisted the Attorney General in this matter.
This press release was made possible by:
