November 24, 2020
Carson City, NV – Today, Nevada Attorney General
Aaron D. Ford and 46 other attorneys general announced a $17.5 million joint settlement
with The Home Depot. The settlement resolves a multistate investigation into their
2014 data breach that exposed the payment card information of approximately 40
million Home Depot customers across the nation. Nevada will receive $150,712.30
from the settlement.
The breach occurred when hackers gained
access to The Home Depot’s network and deployed malware on The Home Depot’s
self-checkout point-of-sale system. The malware allowed the hackers to obtain
the payment card information of customers who used self-checkout lanes at The
Home Depot stores throughout the United States between April 10, 2014 and Sept
13, 2014.
“My office continues to focus on data
security and consumer privacy,” said Attorney General Ford. “Investigations like this one produce meaningful settlements that set a
high floor for the data security standards we expect from companies that handle
the personal information of our consumers.”
In addition to the settlement payment, The
Home Depot has agreed to implement and maintain a series of data security
practices designed to strengthen its information security program and safeguard
the personal information of consumers. Specific provisions arising from the
settlement include:
- Employing a duly
qualified Chief Information Security Officer who will report to both the Senior
or C-level executives and Board of Directors regarding Home Depot’s security
posture and security risks;
- Providing resources
necessary to fully implement the company’s information security program;
- Providing
appropriate security awareness and privacy training to all personnel who have
access to the company’s network or responsibility for United States consumers’
personal information; and
- Employing specific
security safeguards with respect to access controls, password management, two
factor authentication, firewalls, encryption, risk assessments, penetration
testing and vendor account management.
Consistent with previous state data breach
settlements, the company’s implementation of the agreed upon security program
will be evaluated through a post settlement information security assessment.
In addition to Nevada, other states
participating in this settlement include: Alaska, Arizona, Arkansas,
California, Colorado, Connecticut, Delaware, the District of Columbia, Florida,
Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana,
Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri,
Montana, Nebraska, New Jersey, New Mexico, New York, North Carolina, North
Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina,
Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia and
Wisconsin.
###