Home Depot Agrees To Settlement In 2014 Data Breach

ATLANTA, GA — Atlanta-based Home Depot has agreed to a settlement worth $17.5 million with the attorney generals of 46 states six years after a data breach compromised the payment card information of about 40 million customers at locations throughout the country.

Home Depot agreed to employ a chief information security officer and to provide "resources necessary to fully implement the company's information security program" as part of their terms of the agreement, Georgia Attorney General Chris Carr said.

Georgia was among the states involved in the settlement, and will collect $356,366.24 as part of it.

"We believe the Home Depot has been proactive in correcting this situation by taking the necessary measures to address the issue at hand, and our office will continue our work with private, public, state, local and federal partners to make sure that we eliminate the truly bad actors from the playing field,” Carr said.

The 2014 data breach went from April to September and exposed the payment card information of some 40 million customers after cybercriminals hacked into Home Depot’s self-checkout point-of-sale systems using a third-party vendor’s username and password and installed malware that harvested the customer data.

Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, District of Columbia, Florida, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia and Wisconsin were also involved in the settlement.

The Associated Press contributed reporting.