In re The Home Depot, Inc. Shareholder Derivative Litigation

223 F. Supp. 3d 1317, 2016 U.S. Dist. LEXIS 164841, 2016 WL 6995676
CourtDistrict Court, N.D. Georgia
DecidedNovember 30, 2016
DocketCIVIL ACTION FILE NO. 1:15-CV-2999-TWT
StatusPublished
Cited by12 cases

This text of 223 F. Supp. 3d 1317 (In re The Home Depot, Inc. Shareholder Derivative Litigation) is published on Counsel Stack Legal Research, covering District Court, N.D. Georgia primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
In re The Home Depot, Inc. Shareholder Derivative Litigation, 223 F. Supp. 3d 1317, 2016 U.S. Dist. LEXIS 164841, 2016 WL 6995676 (N.D. Ga. 2016).

Opinion

[1320]*1320OPINION AND ORDER

THOMAS W. THRASH, JR., United States District Judge

This is a shareholder derivative action. It is before the Court on the Defendants’ Motion to Dismiss [Doc. 45]. For the reasons set forth below, the Defendants’ Motion to Dismiss [Doc. 45] is GRANTED.

I. Background

This case arises out of the breach of Home Depot’s security systems and the theft of them customers’ personal financial data (the “Breach”) over the course of several months in 2014. Plaintiffs Bennek and Frohman are current Home Depot shareholders, and held shares in Home Depot at the time of the Breach.1 The nominal Defendant, The Home Depot, Inc. (“Home Depot”) is a multinational home improvement retailer that is incorporated in Delaware, with its principal place of business in Georgia.2

Included as defendants in the suit are three current and former officers of Home Depot (the “Officers”). Francis Blake was previously Chairman of the Board from January 2007 to February 2015, and served as CEO during that time until November 2014. Matthew Carey is Home Depot’s Executive Vice President and Chief Information Officer (“CIO”). Craig Menear served as President of Home Depot’s retail division from February to October 2014, and was appointed as CEO, President, and placed on the Board on November 1, 2014. On February 2, 2015, Menear was appointed Chairman of the Board.3

Also included as defendants are a number of current and former members of Home Depot’s Board of Directors. Home Depot’s Board currently consists of twelve members, nine of whom are named as defendants.4 One of them is Menear, who is also the Company’s CEO and President.5 The remaining eight current directors are Defendants Bousbib, Bren-neman, Brown, A. Carey, Codina, Foulkes, Katen, and Vadon, all of whom were Directors when the Breach occurred [1321]*1321(collectively, the “Outside Directors”).6 Defendants Hill and Ackerman are former Directors who were on the Board during the Breach (collectively, the “Former Directors”).7

On September 2, 2014, Home Depot learned that it may have been the victim of a criminal breach of its payment card data systems.8 After an investigation, Home Depot confirmed that the Breach had occurred and that hackers had managed to steal the financial data of 56 million customers between April and September of 2014.9 This followed on the heels of a number of well publicized data breaches that occurred at major retailers like Target and Neiman Marcus the previous year.10 The hackers used a third-party vendor’s user name and password to enter into Home Depot’s network.11 The hackers then gained elevated rights which allowed them to access the rest of Home Depot’s network and install a custom version of mal-ware called BlackPOS.12 A similar version of BlackPOS was used in the Target data breach a few months prior, and essentially allowed the hackers to capture a customer’s financial data every time a card was swiped at one of Home Depot’s Point of Sale (“POS”) terminals (e.g., a cash register).13 A little over a year after the Breach occurred, Home Depot reported that it had registered a net cost to the Company of $152 million.14 After all is said and done, the total cost to Home Depot because of the Breach has been estimated to eventually reach nearly $10 billion.15

In August of 2015, Bennek filed a derivative complaint against Home Depot, and Frohman’s derivative case was later consolidated with Bennek’s. The Plaintiffs allege that the Defendants breached their duty of loyalty to Home Depot because the Defendants failed to institute internal controls sufficient to oversee the risks that Home Depot faced in the event of a breach and because they disbanded a Board of Directors committee that was supposed to have oversight of those risks.16 As a result of their alleged failure to take the risk of a data breach seriously and immediately implement security measures, the Breach occurred.17 The Plaintiffs also allege that the Defendants wasted corporate assets, and that the Current Directors violated Section 14(a) of the Securities Exchange Act in their 2014 and 2015 proxy filings.18

All of the Plaintiffs’ charges against the Defendants ultimately relate to what the Defendants knew before the Breach and what they did about that knowledge. According to the Complaint, Home Depot’s by-laws authorized the Board to delegate any or all of its powers to committees to the extent allowed by law.19 The by-laws provided for no procedure to do this, other than referencing resolutions of the [1322]*1322Board.20 The Company’s Governance Guidelines, however, said that the roles of committees are defined “by the Company’s by-laws and by Committee charters adopted by the Board.”21 When it came to overseeing the company’s information technology (IT) and digital security, Home Depot had previously instituted what was called the Infrastructure Committee.22 The Infrastructure Committee, however, was dissolved by Home Depot in May 2012.23

Home Depot said in its 2012 Proxy Statement that the responsibility for IT and data security which had previously been the domain of the Infrastructure Committee was now being borne by the Audit Committee.24 However, the Audit Committee’s charter was never amended to reflect this change.25 And according to the Complaint, Home Depot’s 2014 and 2015 Proxy Statements, which were issued after the Breach had begun, did not include any indication that the Audit Committee’s charter had not been changed to reflect its new duties.26

In addition to raising the issue of whether anyone had proper oversight over IT and data security, the Complaint also alleges a number of deficiencies in Home Depot’s network security as it stood at the time of the Breach. According to the Complaint, Home Depot’s contracts with financial institutions required them to comply with the Payment Card Industry Data Security Standards (“PCI DSS”), which established a minimum level of protection for data security.27 PCI DSS 2.0, the version of the standards in place at the time of the Breach, required Home Depot to: (1) install and maintain a firewall, (2) protect against malware and regularly update its anti-virus software, (3) encrypt transmission of cardholder data, (4) not store cardholder data beyond the time necessary to authorize a transaction, (5) limit access to payment card data, and (6) to regularly test its data security systems.28

On multiple occasions before the Breach, the Board and the Audit Committee were informed by M. Carey that Home Depot was out of compliance with PCI DSS on multiple levels.29 M. Carey acknowledged that Home Depot was out of compliance, and admitted that Home Depot would likely continue to be out of compliance until February 2015,30 M.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Untitled Case
S.D. Indiana, 2026
James Graham v. Nelson Peltz
Sixth Circuit, 2022
Jerrell Whitten v. Ronald F. Clarke
41 F.4th 1340 (Eleventh Circuit, 2022)
Lee v. Frost
S.D. Florida, 2021
Smith v. Carrillo
D. Delaware, 2019
Martin Conroy v. Paul S. Amos, II
Eleventh Circuit, 2019
McDowell v. Bracken
317 F. Supp. 3d 1162 (S.D. Florida, 2018)
LR Trust ex rel. SunTrust Banks, Inc. v. Rogers
270 F. Supp. 3d 1364 (N.D. Georgia, 2017)

Cite This Page — Counsel Stack

Bluebook (online)
223 F. Supp. 3d 1317, 2016 U.S. Dist. LEXIS 164841, 2016 WL 6995676, Counsel Stack Legal Research, https://law.counselstack.com/opinion/in-re-the-home-depot-inc-shareholder-derivative-litigation-gand-2016.