Home Depot battles bank and consumer lawsuits over data breach

In May consumers filed a complaint in federal court in Atlanta, accusing Home Depot of failing to protect customers' financial information after it emerged that last year a malware-laden cyber-attack on eftpos tills across stores in the US and Canada put the details of 56 million payment cards at risk.

In the suit, Home Depot's attitude towards data security is described as "willfully dismissive", with warnings from the home improvement retailer's own employees neglected.

The company has now hit back, asking for the suit to be dismissed, arguing that the claims have a "fatal defect" because the plaintiffs "have suffered no actual or imminent economic injury that is fairly traceable to Home Depot's alleged conduct".

Whether it succeeds in having the complaint dismissed or not, Home Depot still faces a suit filed last week by banks and credit unions demanding a jury trial, which calls the breach the "inevitable result of Home Depot's longstanding approach to the security of its customer's confidential data, an approach characterized by neglect, incompetence, and an overarching desire to minimize costs".

In an echo of the consumer suit, the financial institutions claim that Home Depot ignored the pleas of its own staff about upgrading its security systems and slams the firm for failing to detect the hack for around five months. The suit says that the card issuers have in large part borne the costs of Home Depot's "misconduct", with community banks and credit unions alone hit with a $150 million bill.

The suit is another sign of growing unhappiness among financial institutions about deals struck between retailers and card schemes. A similar case has been filed against Target, which last month saw its $19 million settlement with MasterCard collapse in the face of opposition from banks and credit unions.