Home Depot agreed to pay at least $19.5 million to compensate U.S. consumers harmed by a 2014 data breach affecting more than 50 million cardholders.

Home Depot also agreed to improve data security over a two-year period, and hire a CISO to oversee its progress, it said. It will separately pay legal fees and related costs for affected consumers, said NBC News.