Home Depot settles suit on card-data breach for $20 million, security pledges

The DIY retail chain was hacked and cybercriminals got away with the details of 56 million payment cards — then they got sued by the banks. Now they've settled.

Home Depot, the hardware retail giant that was robbed of the payment card details of 40 million customers in 2014, has settled a class action consumer lawsuit, agreeing to pay $13 million in cash compensation, spend $6.5 million on ID theft protection and adopt a series of measures to tighten its security.

According to settlement papers filed this week and approved by a federal judge Wednesday, customers who had their personal or financial information compromised and registered last year to be part of the class can get reimbursed for losses from the massive data breach of up to $10,000 each.

The restitution covers: any still-unreimbursed fraudulent charges on cards with stolen data; the costs and expense of identity theft or fraud; any losses losses caused by restricted access to funds like the costs of taking out a loan, or ATM withdrawal fees; and preventative costs against ID fraud like buying credit monitoring.

Home Depot also agreed to pay $15 an hour for up to five hours of time consumers could document as being spent addressing the fallout from the breach.

Those payments will come out of a $13 million fund that Home Depot will establish and KCC Class Action Services will administer.

The retailer also agreed to spend $6.5 million providing free enrollment for 18 months with Identity Guard ID monitoring services to anyone whose personal or financial information was compromised.

Finally, the company agreed to a adopt for at least two years series of business practices designed to shore up the security of its IT networks and the way it handles payment card information.

The measures include “maintaining” a CISO (the company already has one); “routine risk assessments” to find possible flaws in security; a vendor security program (the breach involved a hacked vendor credential); an education and training program on data security and privacy for staff; and the broad use of encryption and minimal-retention standards for payment card data.

“We wanted to put the litigation behind us, and this was the most expeditious path,” company spokesman Stephen Holmes said in a statement. “It’s important to remember that customers were never responsible for any fraudulent charges.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure