The Home Depot has agreed to pay $17.5 million to settle litigation that came from a multistate investigation over a data breach that stole 40 million consumers’ credit card numbers.

The home improvement store also agreed to create a new information security program to protect personal information, to hire a chief information security officer, train its staff about security awareness, and take other safeguards, according to an assurance filed in court.