Colorado to receive more than $200,000 in data breach settlement with The Home Depot

Nov. 24, 2020 (DENVER, Colo.)—Attorney General Phil Weiser today announced that the State of Colorado will receive $223,797.22 in a multistate settlement with The Home Depot, following a data breach that exposed the payment card information of about 40 million Home Depot consumers nationwide.

Weiser, along with the attorneys general of 45 other states and the District of Columbia, obtained a total of $17.5 million in the settlement, which resolved a multistate investigation of the 2014 breach.

The breach occurred when hackers gained access to The Home Depot’s network and deployed malware on The Home Depot’s self-checkout system. The malware allowed the hackers to obtain the payment card information of customers who used self-checkout lanes at The Home Depot stores throughout the U.S. between April 10, 2014, and Sept. 13, 2014.

“The Home Depot violated the Colorado Consumer Protection Act in failing to appropriately protect its customers’ data,” Weiser said. “This settlement will help ensure that the business employs proper measures in the future and demonstrates that we take seriously the rights of Colorado consumers.”

In addition to the $17.5 million total payment to the states, The Home Depot has agreed to implement and maintain a series of data security practices designed to strengthen its information security program and safeguard the personal information of consumers.

Specific information security provisions agreed to in the settlement include:

• Employing a duly qualified Chief Information Security Officer;
• Providing resources necessary to fully implement the company’s information security program;
• Providing appropriate security awareness and privacy training to all personnel who have access to the company’s network or responsibility for U.S. consumers’ personal information;
• Employing specific security safeguards with respect to logging and monitoring, access controls, password management, two factor authentication, file integrity monitoring, firewalls, encryption, risk assessments, penetration testing, intrusion detection, and vendor account management; and
• Consistent with previous state data breach settlements, the company will undergo a post settlement information security assessment which in part will evaluate its implementation of the agreed upon information security program.

The more than $200,000 Colorado will receive will be used by the Attorney General’s Office for reimbursement of the State’s actual costs and attorneys’ fees, and for future consumer fraud or antitrust enforcement, consumer education, or public welfare purposes.

Consumers affected by the data breach were compensated through a previous settlement.

###