Equifax Reaches Settlement with Federal Regulators

Equifax reached a large financial settlement with federal and state regulators last week, stemming from their mishandling of the 2017 data breach that impacted nearly 150 million Americans. 

The settlement would resolve a multi-year investigation with various federal and state regulators, including the Consumer Financial Protection Bureau (CFPB), the Federal Trade Commission (FTC), and 48 states, the District of Columbia, and Puerto Rico. According to a press release by the CFPB, Equifax will pay $700 million in monetary relief and penalties, the majority of which will go directly to consumers. 

“For consumers impacted by the Equifax breach, today’s settlement will make available up to $425 million for time and money they spent to protect themselves from potential threats of identity theft or addressing incidents of identity theft as a result of the breach, said CFPB Director Kathy Kraninger. “We encourage consumers impacted by the breach to submit their claims in order to receive free credit monitoring or cash reimbursements,” concluded Director Kraninger.”

Regulators accused Equifax of engaging in unfair and deceptive acts or practices by doing the following:

• Failing to provide reasonable security for the massive quantities of sensitive personal information stored within its computer network, causing substantial injury to consumers whose data was stolen;

• Deceiving consumers about the strength of its data security program in its privacy policies; and

• Engaging in acts and practices that caused additional harm or risk of harm to consumers in response to the breach.

“Companies that profit from personal information have an extra responsibility to protect and secure that data,” said FTC Chairman Joe Simons. “Equifax failed to take basic steps that may have prevented the breach that affected approximately 147 million consumers. This settlement requires that the company take steps to improve its data security going forward, and will ensure that consumers harmed by this breach can receive help protecting themselves from identity theft and fraud.”