Home Depot agreed to pay $17.5 million to attorneys general representing 45 states and the District of Columbia to resolve a multistate investigation of its 2014 payment-card breach. Announced on November 24, 2020, the state settlement also required the retailer to maintain specified information-security practices. It was separate from the consumer class-action settlement reached in 2016.
What happened in the Home Depot breach?
State attorneys general said hackers accessed Home Depot’s network and installed malware on its self-checkout point-of-sale systems. The malware captured payment-card information used at Home Depot stores in the United States from April 10 through September 13, 2014. The state releases described approximately 40 million consumers nationwide as affected; that is the officials’ estimate, not a count of individually verified victims.
The breach was the subject of the state settlement announced in 2020. The $17.5 million agreement did not concern a new breach.
What did Home Depot agree to in 2020?
On November 24, 2020, attorneys general representing 45 states and the District of Columbia announced that Home Depot would pay a total of $17.5 million to resolve their multistate investigation. The agreement also imposed information-security obligations. The National Association of Attorneys General settlement listing describes requirements that included:
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- A qualified chief information security officer who reports to senior executives and the board.
- Adequate security resources and security-awareness and privacy training.
- Safeguards involving monitoring, access controls, passwords, two-factor authentication, file integrity, firewalls, encryption, risk assessments, penetration testing, and intrusion detection.
- Controls for vendor accounts and a post-settlement security assessment.
The terms describe what Home Depot agreed to do; they do not establish that every measure remains in place today or prove the company’s current security status.
Did consumers receive the $17.5 million?
No. The $17.5 million was the multistate settlement with state governments, not a new payment to consumers. Michigan’s attorney general identifies consumer compensation as part of a separate class-action lawsuit settlement in 2016. The state agreement did not create a new consumer claim or filing deadline.
| Proceeding | What it addressed | Consumer payment |
|---|---|---|
| 2020 multistate settlement | Resolution of the attorneys general’s investigation of the 2014 breach; Home Depot also accepted security-program obligations. | The $17.5 million was paid to resolve the state matter, not as a new direct consumer payout. |
| 2016 consumer class action | A separate lawsuit concerning the breach. | Michigan’s attorney general says consumer compensation was provided through this separate settlement. |
What did state officials say?
Colorado Attorney General Phil Weiser said, “The Home Depot violated the Colorado Consumer Protection Act in failing to appropriately protect its customers’ data.” Ohio Attorney General Dave Yost said, “The Home Depot might have the right hardware for customers but, in this case, it lacked the necessary tools to protect their information.”
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the settlement does—and does not—tell customers
The official state releases identify payment-card information captured through malware on self-checkout systems as the information at issue. They describe the scale as approximately 40 million consumers, an estimate attributed to state officials. The settlement establishes financial and security-program terms for resolving the states’ investigation; it is not evidence by itself of Home Depot’s current compliance or security posture.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
