Home Depot Hit With Class Action Over Unconfirmed Data Breach

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

Home Depot has been hit with a class action lawsuit over a data breach of its in-store payment system that has yet to be confirmed by the home improvement retailer.

The class action lawsuit was filed Thursday by New York resident John Solak and Pennsylvania resident Dennis O’Rourke in a Georgia federal court. Home Depot’s headquarters are in Atlanta.

They allege that Home Depot’s computer system has been under attack by hackers since late April or early May 2014 until the present time.

“The breach likely includes the point-of-sale network that processes credit card and bank debit cards transactions for most, if not all, Home Depot retail stores in the United States,” Solak and O’Rourke claim in their class action lawsuit.

“Unfortunately, the assailants compromised personal and/or financial information for hundreds of thousands, if not millions of individuals in the attack, potentially making it one of the largest data breaches in the history of the world,” they add.

Even though Home Depot has not yet confirmed that their point-of-sale system was compromised, several banks reported on Tuesday that fraudulent transactions occurred on some of their customers debit and credit cards and the one common denominator is that all the customers had shopped at Home Depot, Consumerist.com reported.

When the news was revealed by the banks, the home improvement retailer said that it was conducting an investigation into the “unusual activity” and that the authorities were involved, but it did not confirm that there was a breach and did not say when its investigation would be completed, according to The Atlanta-Journal Constitution.

The story was first broke by KrebsOnSecurity.com, which found almost a 100 percent match between zip codes attached to stolen credit cards that were on sale on the black market earlier in the week and zip codes where Home Depot stores were located.

There was only a small percentage of Home Depot’s 2,200 stores that did not have their zip codes on that list.

If the security breach is confirmed by Home Depot, it could cost the retailer millions.

According to the Home Depot data breach class action lawsuit, the retailer collects its customers’ names, account numbers, expiration date, card verification value (CVV) and PIN for debit cards, which is all stored in a point-of-sale system and then sent to a third party so they payment can be completed.

In addition, “Home Depot also collects and stores customer names, mailing addresses, phone numbers, and email addresses.”

Solak and O’Rourke argue that Home Depot is obligated “to use every means available to it to protect this information from falling into the hands of identity thieves and other criminals.”

Both plaintiffs claim that they are Home Depot customers, who have used a credit card and debit card to make purchases at the retail operation.

Solak claims that his information was among that “being sold on the Internet black market” and that he “faces the imminent” threat of “future additional harm.”

O’Rourke alleges that he used his debit card on Aug. 27 at a Home Depot location and that on Sept. 2, his debit card was “used to make a fraudulent purchase in an amount of $49.95.”

They allege that Home Depot has “unreasonably delayed in informing the public,” which is a violation of state data breach statutes. The plaintiffs are also charging the retailer with negligence for not “safeguarding and securing” the personal information of its customers.

Allegations also include breach of implied contract, bailment, and unjust enrichment.

A spokesperson for Home Depot told The Atlanta-Journal Constitution that it is “premature to comment.”

The plaintiffs are represented by James M. Evangelista, Jeffery R. Harris, Darren W. Penn of Harris Penn Lowry LLP, by William B. Federman and Amy H. Wellington of Federman & Sherwood, and by Cornelius P. Dukelow of Abington Cole.

The Home Depot Data Breach Class Action Lawsuit is John Solak, et al. v. The Home Depot, Inc. filed in the U.S. District Court for the Northern District of Georgia, Atlanta Division.

UPDATE: On Mar. 7, 2016, Home Depot has agreed to pay $13 million to settle the class action lawsuits that followed a massive data breach in 2014.

UPDATE: The Home Depot Data Breach Class Action Settlement is now open! Click here to file a claim or visit www.HomeDepotBreachSettlement.com for more details.