A security breach at the credit-monitoring firm Equifax from May to July of 2017 exposed the personal data of 147 million people – including 2.9 million in Arizona – to hackers. (Photo by Yuri Samoilov/Creative Commons)
WASHINGTON – As many as 3 million Arizonans whose personal data may have been exposed in a 2017 data breach have to decide by Tuesday whether to be part of a settlement with Equifax for that breach.
They can opt out of the settlement now and reserve the right to sue the credit monitoring firm later, or take a settlement that includes up to 10 years of credit monitoring or a cash payment that one advocate said is “less than a parking ticket.”
Even though it’s not much, consumer advocates say it’s probably better to take the sure thing.
“It’s up to the consumers, but if they back out, what do they get?” asked Ed Mierzwinski of the Arizona Public Interest Research Group.
Consumers who opt to stay in the settlement have until Jan. 22 to file a claim for free credit monitoring or a cash payment.
The settlement was negotiated by two federal agencies, 48 states, Puerto Rico and the District of Columbia over the data breach from May to July 2017 that the Federal Trade Commission said affected 147 million consumers – an estimated 2.9 million of whom were in Arizona. Consumers in Canada and the United Kingdom were also affected.
Affected data included personal customer information, such as credit card numbers, Social Security numbers, driver’s license numbers and home addresses, according to court documents. The complaints filed against the company charge that it was aware of security problems in its systems but did not make corrections until after hackers had had more than two months of access to its data.
Under the settlement with the FTC, the Consumer Financial Protection Bureau and the states and territories, Equifax agreed to pay the states $175 million. Arizona’s chunk was $3.5 million, according to a press statement from Arizona Attorney General Mark Brnovich.
The settlement requires that Equifax make up to 10 years of free credit monitoring available to people who were affected, and to provide free identity restoration services. It also sets aside $425 million for payments to consumers, who can get up to $125 if they already have credit monitoring or can get up to $20,000 for out-of-pocket losses as a result of the breach and compensation for their time fighting that loss.
Can I file a claim?
Close to 3 million Arizona consumers may have had their personal data exposed in the 2017 Equifax breach. To find out if your data was affected, go here. To file a claim in the class-action suit, go here. Claims must be filed by Jan. 22, 2020.
But those amounts are expected to be less, based on the number of people who have filed claims so far. Although Equifax stated that it has “the financial capacity to manage the settlement” in a July press release, it said recently that due to the sheer number of filed claims, the compensation payments will “likely will be substantially lowered.”
In a statement on the settlement, Equifax noted that it “denies any wrongdoing, and no judgment or finding of wrongdoing has been made” as part of the deal.
“This comprehensive settlement is a positive step for U.S. consumers and Equifax as we move forward from the 2017 cybersecurity incident and focus on our transformation investments in technology and security as a leading data, analytics, and technology company,” Equifax CEO Mark W. Begor said in the July statement. “We are focused on the future of Equifax and returning to market leadership and growth.”
The company also it is continuing with a $1.25 billion security upgrade that it launched in 2017 after the breach was discovered. Additional security requirements are spelled out in the settlement.
“Nearly 3 million Arizonans had their personal information stolen in the Equifax breach, most of whom did not choose to have Equifax compile sensitive personal information about them and sell it to potential credit grantors and other third parties in the first place,” Brnovich said in a statement after the settlement was announced.
The settlement still needs final approval by the courts, but claims are being processed in the meantime. Brnovich’s office was not able to say how many Arizona consumers have filed a claim.
Consumers are considered class members if they were affected by the Equifax breach, which they can check online. Consumers who choose to remain in the settlement class will still have to file a claim, before Jan. 22, to receive part of the settlement.
The biggest benefit of the settlement is expected to be the free credit monitoring: Four years from the three biggest monitoring agencies, including Equifax, and another six from Equifax alone.
“The settlement sounds like a lot of money … but only $431 million goes directly to consumers. And if any consumer who is a victim of Equifax asks for their compensation to be in the form of cash, they get about 19 cents each,” Mierzwinkski explained.
If they decide – by Tuesday – to back out of the settlement, they will forfeit their compensation or credit monitoring. While that would let them sue Equifax individually, it’s not something Mierzwinski recommends.
“Equifax’s conduct was unbelievable, and they got off with a chump-change settlement that we’re disappointed with,” Mierzwinski said. “It’s less than a parking ticket.”
But it’s better than nothing, he said, noting that some clients have filed for the case compensation just to make a point.
“If you want to get a check for 10 cents and put it on your wall to stick it to Equifax, you can,” Mierzwinski said. “But it might be better to take the credit monitoring.”