Texas Secures $1.8M Settlement After Home Depot Data Breach

AUSTIN, TX — The State of Texas has secured a $17.5 million settlement against retailer Home Depot as part of a multi-state action centered on a data breach, officials said this week.

The Texas attorney general joined counterparts at 45 other states in resolving an investigation into a 2014 data breach said to have exposed payment card information of some 40 million Home Depot consumers nationwide, according to an advisory. Texas — which led the settlement alongside Connecticut and Illinois — is poised to collect $1,777,440, according to the attorney general's office.

The breach occurred when hackers gained access to The Home Depot’s network before deploying malware on the retailer’s self-checkout point-of-sale system. The malware allowed the hackers to obtain the payment card information of customers who used self-checkout lanes at Home Depot stores throughout the U.S. between April 10, 2014, and Sept 13, 2014.

Read a copy of the settlement here

The retailer has since agreed to implement and maintain a series of data security practices designed to strengthen information security programs and safeguard consumers’ personal information, Texas Attorney General Ken Paxton said in a prepared statement. “This settlement serves to promote fair but rigorous compliance with state laws which require businesses that collect sensitive personal information to implement procedures to protect consumers’ information from unlawful use or disclosure.”

As part of the settlement, Home Depot agreed to develop and maintain a comprehensive information security program, including providing resources for the program’s implementation and required training; employing a duly qualified Chief Information Security Officer to oversee the program and advise Home Depot’s Board of Directors of the company’s security risks; and undertaking a post settlement information security assessment, Paxton's office said.