Equifax Inc.

Equifax agreed in 2019 to pay at least $575 million, and potentially as much as $700 million, in a global settlement with the Federal Trade Commission, Consumer Financial Protection Bureau and U.S. states and territories over its massive 2017 data breach. The breach exposed sensitive personal information belonging to approximately 147 million people. According to the FTC, Equifax failed to take reasonable steps to secure its network. The FTC alleged that Equifax failed to ensure that a critical software vulnerability was properly patched even after a security warning had been issued. The company also allegedly failed to adequately segment its network, allowing attackers who gained access to one system to reach other systems containing large amounts of sensitive consumer information. Investigators also identified security problems including the storage of sensitive credentials and information in plain text. Attackers were able to obtain names, dates of birth, Social Security numbers and other sensitive personal information belonging to consumers. Under the settlement, Equifax agreed to establish a fund providing hundreds of millions of dollars for consumer compensation and credit-monitoring services. The resolution also included payments to U.S. states and territories, a civil penalty imposed by the Consumer Financial Protection Bureau and extensive requirements intended to improve Equifax's information-security program. Primary source: Federal Trade Commission — Equifax to Pay $575 Million as Part of Settlement Related to 2017 Data Breach: https://www.ftc.gov/news-events/news/press-releases/2019/07/equifax-pay-575-million-part-settlement-ftc-cfpb-states-related-2017-data-breach

The Consumer Financial Protection Bureau took action against Equifax in January 2017 for deceiving consumers about the usefulness and actual cost of credit scores and other credit-related products. The CFPB found that Equifax represented to consumers that credit scores it sold were the same scores lenders typically used when making credit decisions. According to the Bureau, the scores marketed to consumers were not typically used by lenders for those decisions. The CFPB also found problems with Equifax's marketing of credit-related subscription products. Consumers were offered trial periods or other introductory offers but could subsequently be enrolled in recurring subscription programs if they did not cancel. The Bureau found that the recurring nature and cost of these subscriptions were not sufficiently clearly disclosed to consumers. Equifax was ordered to provide almost $3.8 million in restitution to affected consumers and pay a $2.5 million civil penalty. Primary source: Consumer Financial Protection Bureau — Equifax enforcement action: https://www.consumerfinance.gov/enforcement/actions/equifax-inc-and-equifax-consumer-services-llc/