Home Depot announced that it is facing “at least 44 civil lawsuits” in the United States and Canada stemming from the hacking and compromise of personal data 56 million customers earlier this year.
According to the disclosure, which was released Tuesday as part of the company's quarterly earnings report, "We are also facing investigations conducted by a number of state and federal agencies. These allegations and investigations may adversely affect the way our businesses operate, distract management from operating the business, and result in additional costs and fines.".
One of the lawsuits, filed in late September in federal court in San Francisco, alleges that Home Depot “failed to properly encrypt its customers’ data in violation of the [Payment Card Industry Data Security Standard].” That same month, former Home Depot security employees told the New York Times that the company repeatedly ignored warnings and adopted poor security policies for years.
As the two lead plaintiffs in California allege in their complaint:
Strong encryption is necessary so that if unauthorized access to data is gained, it would be useless and “untraceable” to criminals who would wish to use it for illegal purposes. The rapid availability of unencrypted Home Depot customer data on the black market means that either Home Depot did not encrypt the data or implemented weak encryption standards that allowed “thieves” to decrypt it quickly and easily.
