Attorney General James Helps Secure $17.5 Million After Data Breach at The Home Depot

New York State to Receive Nearly $600,000

NEW YORK – New York Attorney General Letitia James today announced a multistate agreement with The Home Depot, Inc. that resolves an investigation into a massive 2014 data breach, which compromised the payment card information of approximately 40 million consumers nationwide. Today’s agreement resolves the cyberattack by requiring The Home Depot to pay 46 states and the District of Columbia a total of $17.5 million — of which $597,459.80 will go to New York state. In addition to the payment, The Home Depot has also agreed to a series of data security practices designed to strengthen its information security program and safeguard the personal information of consumers.

“New Yorkers have every reasonable expectation that their personal financial information will remain private and protected,” said Attorney General James. “Instead of building a secure system, The Home Depot failed to protect consumers and put their data at risk. My office is committed to protecting consumers, which is why we will continue to use every instrument in our toolbox to hold accountable companies that fail to safeguard personal information.”

The breach occurred when hackers gained access to The Home Depot’s network and deployed malware on the company’s self-checkout point-of-sale system. The malware allowed hackers to obtain the payment card information of customers who used self-checkout lanes at The Home Depot stores throughout the U.S. between April 10, 2014 and September 13, 2014.

As part of the agreement, The Home Depot will also make a series of provisions to its security protocols, including:

• Employing a duly qualified chief information security officer — reporting to both senior or C-level executives and the board of directors regarding The Home Depot’s security posture and security risks;
• Providing resources necessary to fully implement the company’s information security program;
• Providing appropriate security awareness and privacy training to all personnel who have access to the company’s network or responsibility for U.S. consumers’ personal information;
• Employing specific security safeguards with respect to logging and monitoring, access controls, password management, two-factor authentication, file integrity monitoring, firewalls, encryption, risk assessments, penetration testing, intrusion detection, and vendor account management; and
• Undergoing a post settlement information security assessment — consistent with previous state data breach settlements — that, in part, will evaluate its implementation of the agreed upon information security program.

Joining Attorney General James in filing today’s multistate agreement are the attorneys general of Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Jersey, New Mexico, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, and the District of Columbia.

This matter was handled by Deputy Bureau Chief Clark Russell of the Bureau of Internet and Technology, under the supervision of Bureau Chief Kim Berger. The Bureau of Internet and Technology is a part of the Division for Economic Justice, which is led by Chief Deputy Attorney General Chris D’Angelo and overseen by First Deputy Attorney General Jennifer Levy.