1. Home
  2. |Insights
  3. |Home Depot Settles Major Data Breach Suit with Financial Institutions for $25 Million

Home Depot Settles Major Data Breach Suit with Financial Institutions for $25 Million

Client Alert | 1 min read | 03.13.17

On Wednesday, in one of the most high-profile data breach settlements to date, The Home Depot agreed to pay $25 million to settle a consolidated class action involving more than 60 nationwide financial institutions harmed by the retailer’s September 2014 data breach.  That month, the home improvement giant announced that hackers had installed malware on Home Depot’s checkout kiosks and, over a five-month period, stolen credit card information of more than 56 million shoppers.  Immediately thereafter, financial institutions filed more than 25 suits seeking compensation for reissuance fees and fraudulent transaction reimbursements, suits that were then consolidated before a federal court in Atlanta.

The agreement requires the retailer to establish a $25 million settlement fund to reimburse financial institutions for the reissuance of credit cards compromised by the data breach.  The Home Depot has also agreed to a series of additional security measures, including implementing new safeguards developed through a risk exception process and enacting new vendor security programs.

Prior to Wednesday’s announcement, The Home Depot had already spent more than $140 million to settle claims by many of the nation’s large credit card issuers – including MasterCard, Visa, American Express, and Discover – for damages sustained in this breach.

Contacts

Insights

Client Alert | 3 min read | 06.03.26

Important EU Court Judgment Clarifies Rules on Interest Due in Cartel Damages Cases

In a judgment that will have direct and immediate consequences, the Court of Justice of the European Union (CJEU) has clarified that for all competition damages actions brought after 26 December 2014, interest runs from the date on which the harm occurred. The ruling addressed two important questions: (1) whether national provisions implementing Article 3(2) of the EU Damages Directive — which requires interest to run from the date harm occurred —apply to cases in which the harm preceded the adoption of those provisions; and (2) how the date of harm should be determined in cartel cases involving the purchase of goods at inflated prices....

View All Insights