Equifax could pay more than $500 million to resolve a class action lawsuit resulting from its 2017 data breach, which exposed the personal information of about 147 million U.S. consumers.
According to a settlement approved in the Northern District of Georgia this week, Equifax will deposit $380.5 million into a fund for class members. It may end up adding another $125 million if the initial amount isn’t enough to cover class members' claims. In the settlement, the court described the claims rate so far as "unprecedented."
News of the settlement was first reported by BloombergLaw.
Equifax revealed the breach, which compromised consumer information like Social Security numbers and driver's licenses, on Sept. 6, 2017. It drew intense scrutiny from lawmakers, and when the $380.5 million settlement received preliminary approval in July, some consumer groups argued that the figure was too modest. Separately, Equifax agreed to pay $175 million to 48 states, the District of Columbia and Puerto Rico, and another $100 million to the Consumer Financial Protection Bureau.
To date, neither law enforcement nor the company have publicly attributed the cyberattack to any particular party.
Under terms of the settlement, members of the class action will be able to claim up to $20,000 for documented out-of-pocket losses related to the data breach and will also receive 10 years of free credit monitoring services. They may also be eligible to receive compensation for time spent dealing with identity theft, identity restoration services, or alternative cash compensation for those who already have credit monitoring.
The settlement also requires Equifax to spend a minimum of $1 billion improving its data security and technology.
Additionally, Equifax will pay a percentage-based fee of $77.5 million to class counsel, $1.4 million reimbursement for litigation expenses and service awards of $2,500 per settlement class representative, to be capped at $250,000 total.
