Home improvement retailer Home Depot is still locked into a battle over the
security breach it reported in September that put 56 million credit cards at risk. However, the fight is no longer against cyber criminals, but rather consumers affected by the breach and government agencies. To date, the retailer is involved in "at least 44 civil lawsuits" in the US and Canada.
The number of legal actions that Home Depot is facing was uncovered in a November
regulatory filing to the US Securities and Exchange Commission. While the 44 civil suits from affected customers aren't unexpected, Home Depot says that more claims could be coming, including those on "behalf of customers, payment card brands, payment card issuing banks, shareholders or others seeking damages or other related relief, allegedly arising from the data breach." Home Depot believes that payment card issuers will make claims, the result of which could have an effect on its financial position.
Civil actions aren't the only issues that the company is dealing with, as government agencies are also conducting investigations. Home Depot believes that agencies could seek injunctive relief, something that would increase costs for security, have a negative impact on system operations and information collection, and put the company "at a competitive disadvantage with other retailers."
"We are also facing investigations by a number of state and federal agencies. These claims and investigations may adversely affect how we operate our business, divert the attention of management from the operation of the business and result in additional costs and fines," reads the filing.
For investors there is some silver lining, as the company took out a $100 million insurance policy for network security and privacy liability before the intrusion occurred. Under the insurance policy the Home Depot has a $7.5 million deductible, but at this time it only believes $15 million will be reimbursable. So far, the Home Depot has spent $43 million in relation to the breach. However, the company indicates that the full cost of the incident is still unknown.
Even with $43 million spent on the breach, the Home Depot was able to achieve growth in its third quarter results. For the period ending November 2, the company saw a 5.2 percent sales growth year-over-year. Customer transactions were up by 11.1 million compared to 2013, with a total of 355.4 million.
The filing does give some additional clues to the how intrusion occurred. According to Home Depot, the intruder used the user name and password of a vendor to "enter the perimeter of the company's network." Afterward, the intruder was able to gain elevated system rights to access other network areas in order to "deploy unique, custom-built malware" in the Home Depot's self-checkout systems.
Top