Nearly two years after the catastrophic Equifax data breach of 2017 was announced, it looks like the company is readying to cough up damages to any of the 147 million people whose personal information was exposed in the breach.
The proposed deal would put the credit reporting agency out as much as $700 million to settle with federal agencies and 50 U.S. states and territories, the Federal Trade Commission announced Monday, in what will be the largest-ever settlement related to a data breach. Equifax will be required to pay at least $300 million but as much as $425 million and provide free credit monitoring services to victims of the breach. The settlement still requires court approval.
“This comprehensive settlement is a positive step for U.S. consumers and Equifax as we move forward from the 2017 cybersecurity incident and focus on our transformation investments in technology and security as a leading data, analytics, and technology company,” Equifax CEO Mark Begor said in a statement. “The consumer fund of up to $425 million that we are announcing today reinforces our commitment to putting consumers first and safeguarding their data—and reflects the seriousness with which we take this matter.”
Victims will be able to claim up to 10 years of free credit monitoring services for adults and up to 18 years for victims who were minors in May of 2017 (those who already have credit monitoring can instead opt for a payout of $125). Equifax will also pay up to $20,000 to compensate for documented breach-related expenses, including time victims spent dealing with fraud or theft fallout and out-of-pocket costs, the FTC said. Additionally, Equifax will provide free resources for those recovering from identity theft as well as six free credit reports per year for all U.S. consumers beginning in 2020.
In order to collect on the settlement (however small the payout actually turns out to be for each individual victim) or free credit monitoring, you must file a claim. The claims process has not yet started pending court approval, but you can sign up for email notifications about the settlement right here. The settlement states that class members will have six months to claim benefits once the settlement is approved, though the claims window will be extended to four years if the fund for victims has not yet been depleted.
In addition to providing payouts and services to affected parties, the settlement also requires Equifax to overhaul its security protocols and institute safeguards to prevent a similar incident from occurring in the future. It’s a painfully delayed requirement of a company that handles extremely sensitive consumer data like Social Security numbers, dates of birth, home addresses, and other personal information, all of which was exposed in the breach that lawmakers last year determined was “entirely preventable.” But here we are.
FTC Chairman Joe Simons said in a statement this week that companies like Equifax that “profit from personal information have an extra responsibility to protect and secure that data.”
“Equifax failed to take basic steps that may have prevented the breach that affected approximately 147 million consumers,” Simons said. “This settlement requires that the company take steps to improve its data security going forward, and will ensure that consumers harmed by this breach can receive help protecting themselves from identity theft and fraud.”