(Boise) – Attorney General Lawrence Wasden today announced that Idaho and 45 other states and the District of Columbia have obtained a $17.5 million settlement against The Home Depot, resolving a multistate investigation of a 2014 data breach which exposed the payment card information of approximately 40 million consumers nationwide.

Idaho’s share of the settlement is $115,430. The money, by law, will be deposited into the state’s Consumer Protection Fund, subject to future legislative appropriation.

The breach occurred when hackers gained access to The Home Depot’s network and deployed malware on the company’s self-checkout point-of-sale system. The malware allowed the hackers to obtain the payment card information for customers who used self-checkout lanes between April and September 2014.

In addition to the payment to the states, The Home Depot has agreed to implement and maintain a series of data security practices designed to strengthen its information security program and safeguard consumers’ information.

Specific information security provisions agreed to in the settlement include:

  • Employing a duly qualified chief information security officer reporting to both the senior executives and board of directors regarding The Home Depot’s security posture and security risks;
  • Providing resources necessary to fully implement the company’s information security program;
  • Providing appropriate security awareness and privacy training to all personnel who have access to the company’s network or responsibility for U.S. consumers’ personal information;
  • Employing specific security safeguards with respect to logging and monitoring, access controls, password management, two factor authentication, file integrity monitoring, firewalls, encryption, risk assessments, penetration testing, intrusion detection, and vendor account management; and

Consistent with previous state data breach settlements, the company will undergo a post settlement information security assessment which in part will evaluate its implementation of the agreed upon information security program.

###