Tennessee Attorney General Herbert H. Slatery III, along with the attorneys general of 45 other states and the District of Columbia, Wednesday announced a $17.5 million dollar settlement with Georgia-based retailer The Home Depot.

The settlement resolves a multi-state investigation of the 2014 data breach which exposed the payment card information of approximately 40 million customers.

Tennessee will receive $253,004, a news release from Slatery said.

The breach occurred when hackers gained access to The Home Depot’s network and deployed malware on The Home Depot’s self-checkout system. The malware allowed the hackers to obtain the payment card information of customers who used self-checkout lanes at The Home Depot stores throughout the U.S. between April 10 and Sept 13, 2014.

“Your payment information should not be compromised. This office will act to enforce our laws which protect consumers and hold businesses accountable,” Slatery said.

In addition to the payment to the states, The Home Depot has agreed to implement and maintain a series of data security practices to include:

  • employing a duly qualified Chief Information Security Officer reporting to both the senior or C-level executives and board of directors regarding Home Depot’s security posture and security risks;
  • providing resources necessary to fully implement the company’s information security program;
  • providing appropriate security awareness and privacy training to all personnel who have access to the company’s network or responsibility for U.S. consumers’ personal information;
  • employing specific security safeguards with respect to logging and monitoring, access controls, password management, two factor
  • authentication, file integrity monitoring, firewalls, encryption, risk assessments, penetration testing, intrusion detection, and vendor account management; and
  • consistent with previous state data breach settlements, the company will undergo a post settlement information security assessment which in part will evaluate its implementation of the agreed upon information security program.

Recommended for you