Equifax reaches landmark $700m settlement in data breach case
After suffering a data breach in 2017, credit-reporting company Equifax has agreed to pay a $700m settlement, but consumer advocates and lawmakers argue the penalty has not been severe enough
Credit reporting company Equifax will pay $700m to settle US investigations into a data breach it suffered in 2017, it was announced on July 22. Despite being the largest settlement of its kind, consumer advocates argue that it is insufficient to repay the millions of Americans whose data was exposed.
Equifax is one of the ‘big three’ credit reporting agencies alongside Experian and Trans Union. In the summer of 2017, approximately 147 million Equifax customers were affected by the breach, which saw people’s Social Security numbers, driving licence data and addresses compromised.
While there is little evidence that the breach led directly to fraud, the families affected have spent time and money trying to protect their data
Hackers gained access to the information through a security flaw in a web application framework. Equifax later admitted that it had known about the vulnerability two months prior to the breach, but did nothing to fix it.
“Equifax put profits over privacy and greed over people, and must be held accountable to the millions of people they put at risk,” said New York Attorney General Letitia James.
The Federal Trade Commission concluded that Equifax had failed to protect people’s information, ruling that at least $300m of the agreed sum would be paid as compensation to those whose data was exposed. While there is little evidence that the breach led directly to fraud, the families affected have spent time and money trying to protect their data in the aftermath of the breach.
Some feel that the settlement does not go far enough. Democratic US Senator Sherrod Brown said it was “just a drop in the bucket” of what Equifax’s failure could cost US families. Moreover, given the sheer scale of the breach – which was one of the largest in US history – it could be argued that the settlement is inadequate as a deterrent against companies neglecting to safeguard consumer data.
Although a landmark settlement, for Equifax, which is valued at $16.7bn, this is little more than a slap on the wrist for the credit-reporting giant.