Home Depot agreed in 2020 to pay $17.5 million to resolve a multistate investigation into its 2014 payment-card breach. The money was for participating state governments—not a new payout to affected customers—and the agreement also required specified information-security practices.
Why is Home Depot paying $17.5 million?
On November 24, 2020, Ohio Attorney General Dave Yost announced that his office, 45 other states and the District of Columbia had obtained a $17.5 million settlement with Home Depot. The agreement resolved the states’ investigation into the retailer’s 2014 breach. Ohio said its share was $656,210.31. Ohio Attorney General’s announcement
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
The Home Depot eGift Card | $200.00 | Buy on Amazon |
| 2 |
|
The Home Depot eGift Card | $50.00 | Buy on Amazon |
| 3 |
|
Amazon Physical Gift Card in a Mini Amazon Box - Wish List Granted | $50.00 | Buy on Amazon |
| 4 |
|
Lowe's Physical Gift Card | $100.00 | Buy on Amazon |
According to state officials, attackers accessed Home Depot’s network and installed malware on self-checkout point-of-sale systems. The state announcement estimated that payment-card information belonging to approximately 40 million consumers was exposed. The stated U.S. store breach period for affected self-checkout card purchases was April 10 through September 13, 2014. Ohio Attorney General’s announcement
Was the $17.5 million for customers?
No. The $17.5 million resolved the Attorneys General’ multistate investigation; it was not a consumer settlement fund. A separate class action addressed consumer claims and had its own terms.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
- With thousands of products to choose from, The Home Depot is the world's largest home improvement retailer.
- Visit The Home Depot for flooring, paint, bath, kitchen, outdoors living products, appliances as well as tools and hardware.
- More Saving. More Doing.
- Redemption: In-store and Online
- No returns and no refunds on gift cards.
| Settlement track | Who brought it | Amount and purpose | Other terms |
|---|---|---|---|
| Multistate settlement, announced 2020 | Attorneys General from 46 states and the District of Columbia | $17.5 million to resolve the states’ investigation | Required information-security program practices and a post-settlement assessment. Filed assurance |
| Consumer class action, historical 2016 materials | Consumers represented in the class action | Separate $13 million fund, subject to documentation and other settlement limits | Eligible cardholders could elect 18 months of Identity Guard Essentials monitoring; the claims deadline was October 29, 2016. Settlement materials |
The class-action materials also described a stolen file containing email addresses of certain Home Depot customers. That does not mean every person whose payment-card information was exposed also had an email address stolen. Settlement FAQ
Can I still claim money or enroll in monitoring?
The court-authorized class-action FAQ lists October 29, 2016 as the claim deadline. Its reimbursement and monitoring terms are historical; they are not an open claim or enrollment opportunity. Settlement materials
Rank #2
- With thousands of products to choose from, The Home Depot is the world's largest home improvement retailer.
- Visit The Home Depot for flooring, paint, bath, kitchen, outdoors living products, appliances as well as tools and hardware.
- More Saving. More Doing.
- Redemption: In-store and Online
- No returns and no refunds on gift cards.
The $13 million class fund covered eligible documented losses, unreimbursed charges and time spent responding to the breach, subject to the agreement’s documentation requirements, hourly limits and overall caps. Qualifying self-checkout cardholders whose payment data was compromised could enroll in the 18-month monitoring benefit. The settlement FAQ described features including Social Security number and online black-market monitoring, account alerts, identity-theft assistance, lost-wallet protection, username and password protection, and stated identity-theft insurance. These were terms of that historical settlement benefit, not a current product recommendation. Settlement FAQ
What security changes did Home Depot agree to?
The state agreement required an information-security program covering the relevant U.S. cardholder-data environment and related systems. Among the listed commitments were:
Rank #3
- Gift Card is redeemable towards millions of items storewide at Amazon.com
- Gift Card has no fees and no expiration date
- Gift Card is nested inside a specialty gift box
- Free One-Day Shipping (where available)
- Scan and redeem any Gift Card with a mobile or tablet device via the Amazon App
- A qualified chief information security officer (CISO), with responsibility for reporting the company’s security posture and risks to senior or C-level executives and the Board.
- Resources to implement the program, plus security and privacy training for personnel with relevant network access or responsibility for U.S. consumer information.
- Technical and administrative safeguards, including logging and monitoring, access controls, password management, two-factor authentication, file-integrity monitoring, firewalls, encryption, risk assessments, penetration testing, intrusion detection and vendor-account management.
- A post-settlement assessment of whether the agreed program had been implemented.
The filed assurance gives December 21, 2020 as its effective date. These are obligations set out in the agreement; the agreement itself does not establish present-day compliance or guarantee that a future breach cannot occur. Filed assurance
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What Home Depot said about its 2014 response
In a September 18, 2014 statement, Home Depot said it began investigating on September 2 after banking partners and law enforcement reported that criminals might have breached its systems. The company said it had removed the malware from its U.S. and Canadian networks and completed enhanced encryption of payment data at U.S. points of sale. This is Home Depot’s account of its response. Home Depot’s September 18, 2014 statement
Rank #4
- Give the Gift of Possibility With a Lowe’s Gift Card .
- Do you have someone wonderful on your gift list but no great gifting ideas? A Lowe’s Gift Card is the perfect solution.
- With our gift cards, your loved ones can choose what they want. From tools and appliances to paint, flowers and furniture, we truly have something for everyone. No matter the gift-giving occasion, a gift card at Lowe’s is the answer.
- Help your loved ones and friends love their homes and living spaces even more with a Lowe’s Gift Card — a gift that keeps on giving.
- Physical gift cards are delivered active via mail.
That statement also estimated approximately $62 million in gross breach-related costs in the company’s fiscal 2014 earnings guidance, partially offset by a $27 million insurance receivable it believed probable of recovery. Those were estimates at the time, not a final accounting of the breach’s total cost. Home Depot’s September 18, 2014 statement
Did the class-action settlement mean Home Depot admitted wrongdoing?
No. The class-action FAQ said Home Depot denied wrongdoing and that the court made no determination that either side was right. The consumer class action and the states’ separate investigation resolved different legal matters. Court-authorized settlement FAQ
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
