ATLANTA--(BUSINESS WIRE)--In a historic victory for U.S. consumers, credit reporting firm, Equifax (NYSE: EFX), has agreed to settle a nationwide class action stemming from one of the most notorious data breaches in U.S. history. The massive 2017 breach, which exposed the Social Security numbers, birth dates, addresses and, in some cases, the driver’s license and credit card numbers of over 147 million consumers, was resolved in a settlement valued at over $1.5 billion.
The class action settlement includes up to $505.5 million to pay benefits for cash compensation including time spent dealing with the breach, credit monitoring, and assistance with identity restoration. Equifax may have to pay substantially more if greater than 7 million class members enroll in credit monitoring. The settlement also mandates an overhaul of Equifax’s business practices—including its handling of the personal information of consumers nationwide—and requires Equifax to spend at least $1 billion over the next five years to overhaul its data security. The value to the class is even larger. The retail cost of purchasing the same credit monitoring services for the entire class alone would exceed $282 billion.
In January 2019, plaintiffs defeated Equifax’s motion to dismiss the litigation, with U.S. District Court Judge Thomas W. Thrash, Jr. finding that Equifax owed a duty of care to safeguard the personal and financial information in its custody. The Court noted that to hold otherwise would create a “perverse incentive” for businesses that profit off of the use of consumers’ personal data to turn a blind eye and ignore known security risks. This ruling prompted further efforts to resolve the litigation, which began nearly at the same time the case was filed.
“We knew that we wanted to resolve the case as soon as possible for the highest possible consumer relief,” said Norman Siegel of Stueve Siegel Hanson LLP in Kansas City, who served as chair of the settlement committee and was appointed by the court to lead the class action along with Ken Canfield of Doffermyre Shields Canfield & Knowles LLP in Atlanta and Amy Keller of DiCello Levitt Gutzler LLC in Chicago.
Joined by Roy Barnes, the former governor of Georgia and principal of the Barnes Law Group, along with nine other of the top data breach and class action attorneys in the country, this team negotiated a binding agreement with Equifax on March 30, 2019, and committed to working with States Attorneys General, the Consumer Financial Protection Bureau (CFPB), and the Federal Trade Commission (FTC), to consider ways to strengthen the settlement.
“The regulators were helpful in the process and secured additional relief for consumers—such as an additional year of credit monitoring and up to $195 million more in the settlement fund,” said Keller, who at 34 became the youngest woman to ever lead a nationwide multidistrict litigation when she was appointed co-lead counsel in this case. “We are grateful that they worked with us to ensure the best possible outcome for consumers.”
The final details of the settlement were made public today (July 22, 2019), after securities filings and Equifax’s CEO previously hinted at a global resolution.
The Consumer Restitution Fund will be used to pay various benefits to those impacted by the breach including reimbursement for up to $20,000 in out-of-pocket losses; reimbursement for up to 20 hours of time spent dealing with issues relating to the data breach at $25 per hour; a minimum of four years of free, three-bureau credit monitoring through Experian, or a cash payment up to $125 for individuals who already have different credit monitoring; six additional years of single-bureau credit monitoring provided free-of-charge by Equifax; and up to 25% reimbursement for credit or identity monitoring subscription products purchased from Equifax between September 7, 2016, through September 7, 2017.
The settlement will also provide all individuals affected by the breach with Identity Restoration Services, including access to a U.S.-based call center providing services to help class members remedy fraud or identity theft, or identity restoration for seven years. Identity Restoration Services will be available to everyone in the class —regardless of whether or not they submit a claim.
“Navigating complex financial systems when you’ve been the victim of identity theft is a cumbersome – and, in some instances, insurmountable – task for consumers,” Keller added. “We hope that our settlement gives them the assistance and peace of mind they need to move on from this incident.”
“This is a settlement with real teeth, as it not only provides substantial relief to those consumers whose lives have been disrupted by the data theft, but it also ensures Equifax will dramatically improve its security practices moving forward,” Canfield said. “It required close collaboration between private citizens and their counsel and public officials and regulatory bodies to make this settlement a reality, and it’s a great example of the type of concerted effort it will take to advance cybersecurity in this country.”
In addition to spurring national litigation, the Equifax data breach stunned U.S. consumers, legislators, and regulators alike, igniting fears that if Equifax, which has long handled consumers’ most sensitive personal information, was susceptible, then no organization is beyond the reach of cybercriminals. The breach launched a national conversation about consumer privacy, corporate responsibility and the need to strengthen cybersecurity programs nationwide.
“While this settlement cannot come close to righting all of Equifax’s wrongs, it is a critical first step toward making it right, compensating victims and ensuring that in the future, companies do everything in their power to prevent this type of catastrophic breach,” said Gov. Barnes.
The nationwide settlement looms large against a backdrop of Congressional inaction around data privacy. While members of Congress have deemed the Equifax breach “entirely preventable” and sharply rebuked Equifax executives for failing to protect personal data and demonstrating utter “neglect of cybersecurity,” it has been largely left to the American court system to hold organizations accountable for their inattention to cybersecurity practices of corporate America.
“While we know that there are many members of Congress who are making privacy and cybersecurity a priority, the absence of any meaningful federal legislation that would hold companies accountable for egregious cybersecurity lapses like the one we saw in Equifax is unfortunate and is precisely why consumers must be empowered to directly challenge negligent organizations like Equifax,” Siegel said. “This settlement sends a clear message that, if real change is going to happen relative to data security, the American people are going to have to push hard for it.”
The MDL is In re: Equifax Inc. Customer Data Security Breach Litigation, case number 1:17-md-02800, in the U.S. District Court for the Northern District of Georgia.
About Barnes Law Group
Anchored by Georgia’s former Governor Roy E. Barnes, the Barnes Law Group (“BLG”) is a law firm based in Marietta, Georgia with a national distinction for its skill and advocacy in consumer matters. BLG’s legal team is comprised of experienced and dedicated lawyers and staff who have devoted decades in the public and private sectors to “Making It Right” for those who have been wronged. www.barneslawgroup.com
About DiCello Levitt
DiCello Levitt combines excellence in commercial litigation, class action litigation, mass tort litigation, catastrophic injury litigation, medical malpractice litigation, and civil rights litigation. Practicing nationwide—and internationally—from offices in Chicago, Cleveland, New York, and St. Louis, it is an aggressive, attentive, and creative plaintiffs’ firm whose work speaks for itself—billions of dollars in recoveries in some of the highest-profile matters in U.S. history. www.dicellolevitt.com
About Doffermyre Shields Canfield & Knowles
Doffermyre Shields is an Atlanta law firm founded in 1990 with a national practice known for its work on behalf of plaintiffs in complex civil litigation and class actions, including many of the nation's landmark cases over the last two decades. www.dsckd.com.
About Stueve Siegel Hanson
Stueve Siegel Hanson is a Kansas City, Missouri based law firm representing businesses and individuals in high stakes litigation nationwide on a contingency basis. The firm is one of the preeminent plaintiff's trial law firms in the nation, known for its high-stakes, landmark verdicts and settlements in significant individual and class action litigation. Since its establishment in 2001, the firm has led some of the most complex and high-profile cases in state and federal courts throughout the United States, recovering billions in verdicts and settlements. www.stuevesiegel.com