Equifax and Why It’s So Hard to Sue a Company for Losing Your Personal Information (2023)


The Equifax breach is different from previousbreaches. It isn’t the largest or the most embarrassing, but it involves personal data that people didn’t directly give to Equifax, which makes the nature of the breach unique. The company is facing a number of lawsuits, and Congress is demanding answers. But U.S. citizens may find it hard to sue Equifax over the breach. Why? They will have to prove that it was specifically this breach that spilled their personal information across the internet. Reform for the credit reporting industry is unlikely; more likely is that private companies will push for better ways to authenticate people’s identities — which becomes ever more important as people’s private information becomes public.

After years of screaming headlines about data breaches, we all know the drill. A major company announces it has been hacked, a brief public outcry ensues, and then… not much happens. Down the road you might read about a government inquiry or a class-action suit being settled. People have become numb to these announcements. We assume our personal information has been compromised in some way, take reasonable precautions like canceling a credit card or instituting credit monitoring, and move on with our lives.

(Video) Equifax Sued For Wrong Credit Reports! You Could Be A Victim! Must Watch!!

The Equifax breach is different. It isn’t the largest (that would be the 2016 Yahoo breach, with over one billion accounts affected), the most embarrassing (Ashley Madison, the affair website), or the one that raises the most national security concerns (North Korea’s hack of Sony). But a couple of key facts give Equifax its own watershed moment in the sordid history of data breaches: (1) Many of the 143 million people affected may not have given their sensitive information directly to Equifax; and (2) Equifax holds a special place at the core of the personal information and cybersecurity ecosystem.

Equifax finds itself in a crosshairs not seen since the 2013 Target breach; the legal and regulatory repercussions are coming at record speed. At the time of this writing, the credit bureau has been named in more than 50 class-action lawsuits (two were filed within hours of the announcement) and a lawsuit filed by the Massachusetts attorney general. It is also under investigation by the Federal Trade Commission for unfair and deceptive trade practices, the Department of Justice for insider trading, and at least 32 other state attorneys general. Both houses of Congress are demanding information; Equifax’s CEO is expected to testify in the coming weeks. And Canadian and British regulators are commencing their own probes. A long, winding legal road lies ahead.

Let’s start with the first point. Equifax is one of the three major credit bureaus in the United States. It collects personal information — often without people’s direct knowledge — from credit card companies, banks, mortgage lenders, and any other entity that extends credit. In other words, if you have ever borrowed money or been extended credit, then Equifax (along with Transunion and Experian, the other bureaus) was probably given your most sensitive personal information by a third party — information such as your date of birth, Social Security number, financial details, and credit score. The breadth of the information held, and thus potentially compromised in the recent breach, is staggering.

(Video) Equifax case decision -- must have inaccuracy to sue under 1681i of the FCRA

That consumers in most cases do not provide this sensitive information directly to Equifax will raise a number of interesting legal questions in the class-action litigation. It will make getting past the pleading (or motion to dismiss) stage even more difficult for some classes of plaintiffs. Virtually all data breach litigation has been brought by aggrieved consumers who claim they suffered harm after they gave their personally identifiable information directly to a company that got hacked. It’s likely that Equifax will argue that, in terms of protecting the data it collected, it did not have any obligations to the affected individuals, with whom it had no direct relationship, but rather that its obligations were only to its corporate customers.

And unlike in other data breaches, which have primarily led to consumer class-action suits, Equifax faces questions from its corporate customers, too. While consumer outrage has understandably generated most of the publicity, lenders and other corporations are quietly analyzing their Equifax contracts and assessing the potential damage to their own organizations. The vast scope of the breach has companies worried about the effect the incident could have on them, and about whether it could put their own customer or employee information at risk. Indeed, any company that uses personal data to authenticate the identity of customers should now be assessing whether it can sufficiently protect against impersonators in the wake of this kind of large-scale data dump.

In Equifax’s favor is the fact that some of these companies may decide that litigation that will draw them into the public fray in a way that is just not worth it. In addition, as with most other data breach litigation, it’s likely that consumer plaintiffs will have a difficult time demonstrating that any actual harm was done to them, and thus fail to meet the legal standard for standing. That idea of proving harm done has been the albatross around the neck of the plaintiffs’ bar for several years. Plaintiffs in data breaches very often can establish no more than that their data was exposed to unauthorized persons — they struggle to show that they suffered any actual financial harm from the incident, something fatal to their claims. Moreover, when the information, such as a Social Security number, could have been obtained from any number of sources, it is difficult for plaintiffs to establish that any one breach was responsible for the harm they claim to have suffered. While these standing arguments, rooted in constitutional law, cause many data breach litigations to go away quietly, the threat of contract-based claims against Equifax from corporate customers may have a greater chance of succeeding, given their direct relationships with Equifax.

(Video) Can I Sue Equifax For Defamation?

To the second point, Equifax sits at the intersection of cybersecurity and the personal information ecosystem. In normal circumstances, the credit bureaus are who you call for help after you have been hacked, for credit monitoring, identity theft protection, and myriad other services. In fairness, no company is immune to criminal hacking. Putting that aside, the sheer breadth and sensitivity of the information held by Equifax — again, on a staggering 143 million people — will up the ante considerably on damage claims by the plaintiffs and regulators looking for their pound of flesh. And that’s not even counting the reputational damage that Equifax is likely to suffer. Regulators may be looking to hold Equifax to a higher standard in safeguarding information, given the business it is in. And we can be sure that plaintiffs’ lawyers will argue that the attackers, or purchasers of the data on the dark web, are capable of all kinds of mischief, and are determining how they can harness the bootleg data to commit even more lucrative crimes. The ripple effect is palpable.

So if this isn’t a breach that people are numb to, how will we respond to the pain? Lawsuits and investigations are certainly one way. But there willalso besoul-searching aboutthe use of Social Security numbers as authenticators, because it is clear by now that thosenumbers havebeen compromised. Reformingthat system is unlikely. More likely is that private industry will take the lead by driving toward more-robust personal authentication mechanisms, such as biometrics, multifactor authentication, and the like. Companies need to stay ahead of the curve to avoid the painful aftermath of a large-scale breach.


Can Equifax be trusted? ›

Three major credit reporting agencies provide credit reports: Equifax, Experian, and TransUnion. 123 These may be the safest routes to obtaining your credit history, which ultimately affects your personal credit score.

What is Equifax doing about the data breach? ›

More Information About the Settlement

The company has agreed to a global settlement with the Federal Trade Commission, the Consumer Financial Protection Bureau, and 50 U.S. states and territories. The settlement includes up to $425 million to help people affected by the data breach.

How much will each person get from Equifax settlement? ›

Under the settlement terms, Equifax agreed to set up a fund to provide free credit monitoring and identity theft protection to consumers, as well as provide cash payments to people affected by the breach—up to $20,000 per person.

Who is responsible for Equifax breach? ›

According to the indictment, Wu Zhiyong, Wang Qian, Xu Ke, and Liu Lei exploited a vulnerability in the dispute resolution website within the Equifax system. From that initial access point, the hackers used a number of techniques to force their way into the company's network and back-end databases.

Why does Equifax have the worst reputation? ›

Lack of transparency, not only put the company at greater levels of company risk, it also served to unknowingly expose millions of consumers to higher levels of personal risk. This in turn makes the General Public less forgiving of Equifax in how it handled the issue.

Who is better TransUnion or Equifax? ›

Neither score is more or less accurate than the other; they're only being calculated from slightly differing sources. Your Equifax credit score is more likely to appear lower than your TransUnion one because of the reporting differences, but a “fair” score from TransUnion is typically “fair” across the board.

How much compensation can you get for a data breach? ›

If the data breach has caused you bodily or emotional harm, you may be entitled to compensation of up to £42,900. You must, however, present proof of your physical condition and financial losses in such circumstances.

What are the harms of Equifax? ›

In its complaint, the FTC alleges that Equifax failed to secure the massive amount of personal information stored on its network, leading to a breach that exposed millions of names and dates of birth, Social Security numbers, physical addresses, and other personal information that could lead to identity theft and fraud ...

Is there a Equifax data breach settlement? ›

If you were affected by the Equifax data breach, you can still claim financial reimbursement for costs you incurred, or time you spent dealing with fraud or identity theft, after January 22, 2022. Claims are due by January 22, 2024. For more details, visit EquifaxBreachSettlement.com .

Will Equifax pay $125? ›

If you asked for money

If you requested compensation of up to $125 or reimbursement for time spent recovering from fraud or ID theft, a check or debit card will be mailed to the address you used when submitting your claim. Be prepared for compensation that is much less than you requested.

Is Equifax being sued? ›

Equifax misrepresented potentially millions of credit scores, lawsuit alleges. (Reuters) - Equifax has been hit with a lawsuit accusing it of knowingly allowing a glitch in its coding system to result in inaccurate credit scores for potentially millions of consumers.

Who qualifies for Equifax settlement? ›

You are a Settlement Class Member if you are among the approximately 147 million U.S. consumers identified by Equifax whose personal information was impacted by the Equifax Data Breach.

How much is Equifax settlement? ›

The company has agreed to a global settlement with the Federal Trade Commission, the Consumer Financial Protection Bureau, and 50 U.S. states and territories. The settlement includes up to $425 million to help people affected by the data breach.”

What law did Equifax breach? ›

Equifax Inc. has to face claims tied to its 2017 data breach of violating New York consumer protection law in failing to protect the information, a federal court ruled.

Can I sue Equifax? ›

You can sue Equifax, but you may need to take certain steps depending on the reason. Suing Equifax requires that Equifax did something wrong like Equifax reporting you as dead, Equifax mixed you up with someone else, Equifax refused victim's rights with identity theft, or failed to investigate a credit error.

Who owns Equifax? ›

FoundersCator Woolford Guy Woolford
HeadquartersAtlanta, Georgia , U.S.
Area servedWorldwide
Key peopleMark L. Feidler (Chairman) Mark W. Begor (CEO) John W. Gamble, Jr. (Vice President & CFO)
RevenueUS$4.92 billion (2021)
14 more rows

How do I know if my Equifax breach is affected? ›

Equifax has created a website where you can find out if you have been affected by the breach. The website will ask you for the last six digits of your social security number and your last name, and then will tell you if you have been affected. You can also call 1-833-759-2982.

What is a good credit score? ›

Although ranges vary depending on the credit scoring model, generally credit scores from 580 to 669 are considered fair; 670 to 739 are considered good; 740 to 799 are considered very good; and 800 and up are considered excellent.

Do banks use Equifax or TransUnion? ›

Answer provided by. “In general, lenders have a preferred credit report between Equifax, Experian, or TransUnion. However, they may pull more than one credit report if they can't determine if you qualify for a loan based on one.

Which of the 3 credit scores is most important? ›

Which credit score matters the most? While there's no exact answer to which credit score matters most, lenders have a clear favorite: FICO® Scores are used in over 90% of lending decisions.

Is Equifax better than Experian? ›

2 Experian has a slight edge over Equifax because it tends to track recent credit searches more thoroughly. Experian breaks down a credit report into sections, which include the following: Personal information including past addresses. Employment.

Can you sue a company for losing your personal information? ›

Data breach lawsuits generally become valid once the individual suffers damage from the data breach through criminal or civil injuries such as financial information shared and used through identity theft or the loss of income from the online activity.

Can I sue for data loss? ›

Can I Sue a Company For a Data Breach? Yes, after a data breach, those affected can bring a data breach lawsuit against the company. However, to succeed in their claim, the victim must prove that the company was negligent or otherwise violated the United States data breach laws.

Can you sue for personal data breach? ›

Under data protection law, you are entitled to take your case to court to: enforce your rights under data protection law if you believe they have been breached. claim compensation for any damage caused by any organisation if they have broken data protection law, including any distress you may have suffered, or.

Has Equifax been hacked? ›

In a report released today, the House Committee on Oversight declared that the Equifax breach, which affected 148 million U.S. consumers, was "entirely preventable." The breach, one of the largest in U.S. history, compromised the authenticating details, including dates of birth and social security numbers, of more than ...

What happened to the Equifax settlement? ›

WASHINGTON D.C. (WWLP) – Consumers who were impacted by a 2017 data breach of the credit reporting company Equifax, and filed a claim, will begin getting information on a settlement soon. According to the Federal Trade Commission (FTC) the settlement was finalized in January 2022.

What information does Equifax store? ›

Credit account information as reported to Equifax by your lenders and creditors. This information includes the types of accounts, the date those accounts were opened, your credit limit or loan amount, current balances on the accounts and payment history.

How long does a data breach claim take? ›

In reality, how long a data breach claim takes simply comes down to the circumstances of the case. Some cases could be resolved in a few months, whereas others may end up being pursued for several years.

How much can individuals sue companies for in the event of a data breach? ›

For knowing and reckless data breach notification violations, the court may impose penalties beginning at $5,000 dollars or up to $20 per violation with a cap of $250,000. For data breach safeguard violations, the court may impose penalties of no more than $5,000 per violation.

How do you claim a data breach? ›

It is possible to make a data breach claim for compensation but you must be able to provide evidence that you have suffered damages and stress as a result of the data breach. The current period for making a data breach claim is 6 years, 1 year if it involves a breach of Human Rights.

What are the benefits of Equifax? ›

Equifax Complete™ Premier
  • Know where you stand with access to your 3-bureau VantageScore credit scores and report.
  • Help monitor your credit and Social Security number. ...
  • Uncover potential fraud with credit monitoring and alerts.

What happened to the Experian lawsuit? ›

Experian credit reporting class action settlement overview:

Experian has agreed to pay $22.45 million to resolve claims it hurt consumers' ability to get credit by adding allegedly inaccurate and untrue information to their credit reports.

Which Credit Bureau had a data breach? ›

On Sept. 7, 2017, the Equifax credit bureau publicly revealed its computer networks had suffered a data leak that exposed the personal information of 143 million consumers, a number later raised to 147 million.

How long does an Equifax dispute take? ›

If you file a dispute regarding information on your Equifax credit report, you can generally expect to receive the results of the investigation within 30 days. If the information on your credit report is found to be inaccurate or incomplete, your credit report will be updated, generally within about 30 days.

What is a data breach? ›

A data breach is an incident where information is stolen or taken from a system without the knowledge or authorization of the system's owner. A small company or large organization may suffer a data breach.

How much is the Capital One settlement? ›

Today is the final day that Capital One customers can claim part of a $190 million settlement stemming from a massive 2019 data breach that exposed more than 100 million people's personal information.

What is Straffic breach? ›

The Israeli marketing firm Straffic accidentally exposed 49 million unique email addresses stored in an Elasticsearch database. The Israeli marketing firm Straffic exposed 49 million unique email addresses due to mishandled credentials for an Elasticsearch database.

How do I file a claim with Equifax? ›

Equifax: File a dispute online or call 866-349-5191. Experian: File a dispute online or call 888-397-3742.

How long will Equifax provide credit monitoring? ›

Closed accounts paid as agreed. If the last status of the account is reported by the lender as paid as agreed, the account can stay on your Equifax credit report for up to 10 years from the date it was reported by the lender to Equifax.

How accurate is Credit Karma? ›

The credit scores and reports you see on Credit Karma should accurately reflect your credit information as reported by those bureaus. This means a couple of things: The scores we provide are actual credit scores pulled from two of the major consumer credit bureaus, not just estimates of your credit rating.

How secure is Equifax? ›

How secure is the information I provide to Equifax.com? Social Security number and credit card number(s) are encrypted before being transmitted to/from our servers. For your security, this site requires the use of a 128-bit SSL compatible browser.

Is Equifax accurate? ›

Is Equifax accurate? Each credit reference agency has access to different information, so it is unlikely your credit report will be the same with Equifax as it is with Experian or TransUnion.

Which federal agency filed a complaint against Equifax? ›

agreed to pay at least $575 million, and potentially up to $700 million, as part of a global settlement with the Federal Trade Commission, the Consumer Financial Protection Bureau (CFPB), and 50 U.S. states and territories to settle allegations that the credit reporting company's failed to take reasonable steps to ...

What did Equifax do after the breach? ›

Specifically, he says, Equifax's most important post-breach initiatives included: Improving systems monitoring; Enhancing the security team's communication with the C-suite; Changing the corporate culture by getting employees to recognize the importance of cybersecurity.

Can you sue for wrong information on credit report? ›

Consider Suing the Credit Reporting Agency or Creditor

If you were seriously harmed—say, the credit reporting agency continued to give out incomplete or inaccurate information after you requested corrections—consider filing a lawsuit. Under the Fair Credit Reporting Act (FCRA) (15 U.S.C.

What banks use Equifax? ›

Banks that typically use Equifax data
  • Discover it Cash Bank.
  • Discover it Balance Transfer.
  • Discover it Miles.
  • Chase Freedom Flex.
  • Chase Unlimited Freedom.
  • Chase Slate Edge.
  • Citi Double Cash Card.
  • Citi Premier Card.
19 Sept 2022

What is the difference between Equifax and Experian? ›

Experian provides monthly data for each account including the minimum payment due, payment amounts, and balances. Equifax lists accounts in groupings of “open” or “closed,” which makes it easy to view current versus old credit data.

Will affect my credit score if I check on Equifax? ›

Good news: Credit scores aren't impacted by checking your own credit reports or credit scores. In fact, regularly checking your credit reports and credit scores is an important way to ensure your personal and account information is correct, and may help detect signs of potential identity theft.

Does Experian give an accurate credit score? ›

Is Experian Accurate? Credit scores from the credit bureaus are only as accurate as the information provided to the bureau. Check your credit report to ensure all the information is correct. If it is, your Experian credit scores are accurate.

Is Creditkarma accurate? ›

Here's the short answer: The credit scores and reports you see on Credit Karma come directly from TransUnion and Equifax, two of the three major consumer credit bureaus. The credit scores and reports you see on Credit Karma should accurately reflect your credit information as reported by those bureaus.

Do banks use Experian or Equifax? ›

However, most smaller lenders typically use Equifax. Also, since the introduction of Comprehensive Credit Reporting from July 2018, Experian's credit report will also reflect new information such as the 24 month repayment history, type of credit and loan amount, nature of credit account, etc.

Which credit bureau is most accurate? ›

Although Experian is the largest credit bureau in the U.S., TransUnion and Equifax are widely considered to be just as accurate and important. When it comes to credit scores, however, there is a clear winner: FICO® Score is used in 90% of lending decisions.

Which credit bureau is most important? ›

There's no “most important” credit bureau. Reviewing reports from all three bureaus can help you understand what information might be used to calculate your credit scores. But remember, lenders have their own criteria to decide on things like loan and credit applications.

How do you get a 900 credit score? ›

7 ways to achieve a perfect credit score
  1. Maintain a consistent payment history. ...
  2. Monitor your credit score regularly. ...
  3. Keep old accounts open and use them sporadically. ...
  4. Report your on-time rent and utility payments. ...
  5. Increase your credit limit when possible. ...
  6. Avoid maxing out your credit cards. ...
  7. Balance your credit utilization.
30 Sept 2021

Which banks use Equifax? ›

Banks that typically use Equifax data
  • Discover it Cash Bank.
  • Discover it Balance Transfer.
  • Discover it Miles.
  • Chase Freedom Flex.
  • Chase Unlimited Freedom.
  • Chase Slate Edge.
  • Citi Double Cash Card.
  • Citi Premier Card.
19 Sept 2022

How do you know if you were affected by Equifax? ›

Equifax has created a website where you can find out if you have been affected by the breach. The website will ask you for the last six digits of your social security number and your last name, and then will tell you if you have been affected. You can also call 1-833-759-2982.

Is 650 a good credit score? ›

A FICO® Score of 650 places you within a population of consumers whose credit may be seen as Fair. Your 650 FICO® Score is lower than the average U.S. credit score. Statistically speaking, 28% of consumers with credit scores in the Fair range are likely to become seriously delinquent in the future.

What is a good Equifax score? ›

Although ranges vary depending on the credit scoring model, generally credit scores from 580 to 669 are considered fair; 670 to 739 are considered good; 740 to 799 are considered very good; and 800 and up are considered excellent.

What's a bad credit score? ›

The company says a credit score is poor if it's between 500 and 600, while a score from 300 to 499 is called very poor. “In general, people with higher scores can get more credit at better rates,” VantageScore says.

How many points off is Credit Karma? ›

Credit Karma touts that it will always be free to the consumers who use its website or mobile app. But how accurate is Credit Karma? In some cases, as seen in an example below, Credit Karma may be off by 20 to 25 points.

Can I get a loan with a 628 credit score? ›

Your score falls within the range of scores, from 580 to 669, considered Fair. A 628 FICO® Score is below the average credit score. Some lenders see consumers with scores in the Fair range as having unfavorable credit, and may decline their credit applications.

What type of credit score is needed to buy a house? ›

It's recommended you have a credit score of 620 or higher when you apply for a conventional loan. If your score is below 620, lenders either won't be able to approve your loan or may be required to offer you a higher interest rate, which can result in higher monthly payments.


(The Credit Repair Shop)
2. Equifax Lawsuit
(Good Day Sacramento)
3. How To File Complaints With The CFPB in 2022
(Marvin Francois)
4. Equifax and Why Your Disputes May Not Be Working
(Bill Clanton)
5. Woman sues over Equifax error
6. How to Deal with Equifax Hack
(Brian L. Ponder, Esq.)
Top Articles
Latest Posts
Article information

Author: Tish Haag

Last Updated: 01/20/2023

Views: 5679

Rating: 4.7 / 5 (67 voted)

Reviews: 82% of readers found this page helpful

Author information

Name: Tish Haag

Birthday: 1999-11-18

Address: 30256 Tara Expressway, Kutchburgh, VT 92892-0078

Phone: +4215847628708

Job: Internal Consulting Engineer

Hobby: Roller skating, Roller skating, Kayaking, Flying, Graffiti, Ghost hunting, scrapbook

Introduction: My name is Tish Haag, I am a excited, delightful, curious, beautiful, agreeable, enchanting, fancy person who loves writing and wants to share my knowledge and understanding with you.