💸 Equifax agreed to pay at least $575M over 2017 data breach

Equifax agreed to pay at least $575 million, and potentially up to $700 million, the Federal Trade Commission said when it announced a global settlement with the FTC, the Consumer Financial Protection Bureau (CFPB) and 50 U.S. states and territories. The claims centered on a 2017 breach that the FTC says affected approximately 147 million people.

The FTC's complaint alleges that Equifax failed to take reasonable steps to secure its network. The press release does not record Equifax's answer to those allegations. The company's own breach site says it reached a comprehensive resolution that includes a class action settlement.

Where the $575 million went

The arithmetic is tidy: $300 million, $175 million and $100 million make $575 million. The FTC release also says Equifax would provide all U.S. consumers six extra free credit reports a year for seven years from January 2020, and submit to third-party assessments of its security program every two years.

"Companies that profit from personal information have an extra responsibility to protect and secure that data."

FTC Chairman Joe Simons, in the FTC's July 2019 settlement announcement

Who got paid, and who got paid less

On Dec. 19, 2019, a Georgia federal judge awarded $77.5 million to the attorneys for the consumer class, CNBC reported. The Hamilton Lincoln Law Institute, which opposed the fee, said that is over 20% of a roughly $380 million fund. Its litigation director, Ted Frank, told CNBC the settlement's beneficiaries are really the attorneys. Amy Keller, co-lead counsel for consumers, told CNBC that people who spent money responding to the breach can still be fully reimbursed.

Cash was the thin part. The New York Times reported that only $31 million was set aside for the cash option, and more than 4.5 million people had filed for it as of Dec. 1, 2019. That works out to less than $7 a person, against a $125 cap. The Times also reported that just over 10% of the roughly 147 million eligible consumers had filed for any compensation by then.

The FTC settlement page says the claim deadline was Jan. 22, 2024, and that free identity restoration services are available until January 2029 to people who discover misuse of their data.

What the FTC says happened

The complaint alleges Equifax was alerted to a critical vulnerability in March 2017. Its security team ordered affected systems patched within 48 hours, but the FTC alleges nobody followed up. Equifax did not find the database unpatched until July 2017, the FTC says. The FTC also alleges hackers found administrative credentials stored in plain text. Equifax's privacy policy at the time promised "reasonable physical, technical and procedural safeguards."

The other bills

Equifax told TechCrunch it was disappointed by the ICO's penalty, apologized to consumers who were put at risk, and said it had made changes in response. The Justice Department says Ying pleaded guilty to insider trading. GovInfoSecurity, citing the company's own figures, reported the breach cost Equifax $1.4 billion over two years.

MrMoney's reading of the ledger: regulators got their line items, the lawyers got a fee, and the consumer cash option got a footnote. Everything above is on the record. How much consumers ultimately received is not.