Settlement includes up to $425 million in consumer restitution
Attorney General Hector Balderas announced on July 22 that a coalition of 50 Attorneys General reached a settlement with Equifax as the result of its massive 2017 data breach. The investigation found that Equifax’s failure to maintain a reasonable security system enabled hackers to penetrate its systems, exposing the data of more than half of all American adults - the largest-ever breach of consumer data. They secured a settlement with Equifax that includes up to $425 million in consumer restitution, a $175 million payment to the states, and an injunction requiring significant improvements to Equifax’s business and data security practices. This is the largest data breach enforcement action in U.S. history, bringing millions of dollars of restitution to New Mexican consumers and nearly $2.3 million to the State.
“My office will continue to hold powerful companies accountable and to safeguard the personal information of all New Mexican families,” Balderas said. “We must continue to be vigilant in protecting the privacy of all New Mexicans.”
On Sept. 7, 2017, Equifax, one of the largest consumer reporting agencies in the world, announced a data breach affecting more than 147 million consumers, more than 860,000 of whom live in New Mexico. Breached information included social security numbers, names, dates of birth, addresses, credit card numbers, and in some cases, driver’s license numbers.
Under the terms of the settlement, Equifax will provide a single Consumer Restitution Fund of up to $425 million - with $300 million dedicated to consumer redress. If the initial $300 million in the fund is exhausted, Equifax will be required to contribute up to an additional $125 million. The company must also offer affected consumers extended credit monitoring services for a total of 10 years, and must take steps to assist consumers who are either facing the threat of identity theft or who have already had their identities stolen.
Equifax must also significantly strengthen its security practices going forward, including strengthening its internal data security and patch management teams, minimizing its collection and use of sensitive information, increasing network monitoring and testing, improving access controls, and segmenting its network to thwart future attacks.
Finally, Equifax will pay the state Attorneys General a total of $175 million, which includes nearly $2.3 million for New Mexico. These funds are separate and apart from the restitution fund, and will be used to bolster the Attorney Generals’ data security investigation and consumer protection efforts.
Consumers who believe they are eligible for restitution may submit claims online or by mail. Paper claims forms can be requested by phone. Consumers can obtain information about the settlement, check their eligibility to file a claim, and file a claim on the Equifax Settlement Breach online registry, set to launch soon after this announcement.
To receive email updates regarding the launch of this online registry, consumers can sign up at www.ftc.gov/equifax-data-breach. Consumers can also call the settlement administrator at (833) 759-2982 for more information. The program to pay restitution to consumers will be conducted in concert with settlements that have been reached in the multi-district class actions filed against Equifax, as well as settlements that were reached with the Federal Trade Commission and Consumer Financial Protection Bureau.
