Tuesday, July 23, 2019
Associated Press
NEW YORK
Equifax has agreed to pay $700 million, potentially more, to settle with the federal authorities and states over its 2017 data breach that exposed the Social Security numbers and other private information of nearly 150 million people, roughly half of the U.S. population.
The settlement with the Consumer Financial Protection Bureau and the Federal Trade Commission, as well as 48 states, the District of Columbia and Puerto Rico, would provide up to $425 million in monetary relief to consumers, a $100 million civil money penalty, and other relief.
The breach was one of the largest ever to threaten the private information. The consumer reporting company, based in Atlanta, did not detect the attack for more than six weeks. The compromised data included Social Security numbers, birth dates, addresses, driver license numbers, credit-card numbers and in some cases, data from passports. The breach resulted in the abrupt dismissal of Equifax’s then CEO, as well as numerous other executives at the company.
The relief is coming in multiple forms. Equifax will pay initially $380.5 million into a fund to cover potential identity theft that was caused as a result of the breach, as well as any costs that a potential victim had to pay for credit monitoring. An additional $125 million would be paid additionally by Equifax if victims’ out-of-pocket expenses end up depleting the initial fund. Equifax could also potentially pay $2 billion to cover credit monitoring services if all 147 million victims sign up for credit monitoring services.
Victims of Equifax’s breach will be eligible for up to 10 years of credit monitoring services for free, seven years of identity-restoration services and six free copies of Equifax’s credit reports per year for the next seven years.