November 24, 2020
LANSING – Attorney General Dana Nessel announced today that her office, along with the attorneys general of 45 other states and the District of Columbia have obtained a $17.5 million settlement against Georgia-based retailer The Home Depot, resolving a multistate investigation of a 2014 data breach which exposed the payment card information of about 40 million The Home Depot consumers nationwide. Michigan will receive more than $300,000 through this settlement.
The breach occurred when hackers gained access to The Home Depot’s network and deployed malware on its self-checkout point-of-sale system. The malware allowed the hackers to obtain payment card information of customers who used self-checkout lanes at The Home Depot stores throughout the U.S. between April 10, 2014 and Sept. 13, 2014.
In addition to the $17.5 million total payment to the states, The Home Depot provided compensation to consumers through a separate 2016 settlement in a class action lawsuit.
Besides the financial settlements, The Home Depot also agreed to implement and maintain a series of data security practices designed to strengthen its information security program and safeguard the personal information of consumers.
“Businesses that collect or maintain sensitive personal information must take certain measures to ensure that material is secure and protected from unlawful use or disclosure,” Nessel said. “I am pleased with this settlement as it sets procedures in place that The Home Depot must follow to further protect consumers’ interests and provide them peace of mind as they shop.”
Specific information security provisions agreed to in the settlement include: