Press Release

Home Depot Agrees to Multi-State Settlement Regarding Data Breach

November 25, 2020

(Anchorage, AK) – Acting Attorney General Ed Sniffen announced today along with the Attorneys General of 45 other States and the District of Columbia, a $17.5 million-dollar settlement against Georgia-based retailer The Home Depot. This resolves a multistate investigation of a 2014 data breach which exposed the payment card information of approximately 40 million Home Depot consumers nationwide. The State of Alaska will collect $86,639 through this settlement.

The breach occurred when hackers gained access to The Home Depot’s network and deployed malware on the self-checkout point-of-sale system. The malware allowed the hackers to obtain the payment card information of customers who used self-checkout lanes at The Home Depot stores between April 10, 2014 and Sept 13, 2014.

In addition to the $17.5 million total payment to the states, The Home Depot has agreed to implement and maintain a series of data security practices designed to strengthen its information security program and safeguard the personal information of consumers.

“This settlement serves to promote fair but rigorous compliance with state laws requiring businesses collecting sensitive personal information to implement and adhere to reasonable procedures to protect consumers’ information from unlawful use or disclosure,” says Acting Attorney General Ed Sniffen.

Specific information security provisions agreed to in the settlement include:

Employing a duly qualified Chief Information Security Officer reporting to both the Senior or C-level executives and Board of Directors regarding Home Depot’s security posture and security risks;
Providing resources necessary to fully implement the company’s information security program;
Providing appropriate security awareness and privacy training to all personnel who have access to the company’s network or responsibility for U.S. consumers’ personal information;
Employing specific security safeguards with respect to logging and monitoring, access controls, password management, two factor authentication, file integrity monitoring, firewalls, encryption, risk assessments, penetration testing, intrusion detection, and vendor account management; and
Consistent with previous state data breach settlements, the company will undergo a post settlement information security assessment which in part will evaluate its implementation of the agreed upon information security program.

Other states participating in this settlement include: Arizona, Arkansas, California, Colorado, Connecticut, Delaware, District of Columbia, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia, and Wisconsin.

# # #

Department Media Contacts: Communications Director Patty Sullivan at patty.sullivan@alaska.gov or (907) 269-6368. Information Officer Sam Curtis at sam.curtis@alaska.gov or (907) 269-6269.