Equifax agreed to pay up to $700 million over data breach exposing information of about 147 million people

Summary

Equifax agreed in 2019 to pay at least $575 million, and potentially as much as $700 million, in a global settlement with the Federal Trade Commission, Consumer Financial Protection Bureau and U.S. states and territories over its massive 2017 data breach. The breach exposed sensitive personal information belonging to approximately 147 million people. According to the FTC, Equifax failed to take reasonable steps to secure its network. The FTC alleged that Equifax failed to ensure that a critical software vulnerability was properly patched even after a security warning had been issued. The company also allegedly failed to adequately segment its network, allowing attackers who gained access to one system to reach other systems containing large amounts of sensitive consumer information. Investigators also identified security problems including the storage of sensitive credentials and information in plain text. Attackers were able to obtain names, dates of birth, Social Security numbers and other sensitive personal information belonging to consumers. Under the settlement, Equifax agreed to establish a fund providing hundreds of millions of dollars for consumer compensation and credit-monitoring services. The resolution also included payments to U.S. states and territories, a civil penalty imposed by the Consumer Financial Protection Bureau and extensive requirements intended to improve Equifax's information-security program. Primary source: Federal Trade Commission — Equifax to Pay $575 Million as Part of Settlement Related to 2017 Data Breach: https://www.ftc.gov/news-events/news/press-releases/2019/07/equifax-pay-575-million-part-settlement-ftc-cfpb-states-related-2017-data-breach