Home Depot Cybersecurity Settlement Sets Model For Resolving Data Breach Claims

On March 8, 2016, the United States District Court for the Northern District of Georgia preliminarily approved a proposed $19.5 million settlement of a class action lawsuit against Home Depot, stemming from the 2014 cyber-attack against the company. See Order Certifying a Settlement Class, Preliminarily Approving Class Action Settlement and Directing Notice to the Settlement Class, In re The Home Depot, Inc., Customer Data Security Litigation, No. 1:14-md- 02583-TWT (N.D. Ga. Mar. 8, 2016) (Dkt. 185). The attack, which used the stolen credentials of a third-party vendor, compromised approximately 53 million email addresses and 56 million credit card accounts.

Under the proposed settlement, Home Depot would create a $13 million fund to reimburse its affected customers for certain out-of-pocket expenses. An additional $6.5 million would fund 18 months of identity protection services for affected customers.