Massachusetts and Indiana, the only two U.S. states that independently sued Equifax over the massive data breach that occurred in 2017, have settled with the credit reporting agency for a total of close to $40 million.
The Equifax data breach affected roughly 147 million people. Hackers gained access to information such as social security numbers, dates of birth, driver license numbers, payment card numbers and even passport information. The U.S. government has charged four members of the Chinese People’s Liberation Army (PLA) for their role in the cyberattack.
Following the incident, Equifax was sued by both consumers and authorities over its failure to protect sensitive personal information, including by the Federal Trade Commission (FTC), the Consumer Financial Protection Bureau (CFPB), and 50 states.
As part of a settlement approved in January, Equifax will have to set aside $380 million for payments to affected individuals, attorney fees of $80 million, and other costs. The states that filed a lawsuit against the company will receive a total of $175 million.
However, Massachusetts and Indiana are not included in that multistate settlement as they filed their own lawsuits against Equifax. The attorneys general of Massachusetts and Indiana announced last week that they have each reached a settlement with the company for $18.2 million and $19.5 million, respectively.
The Equifax breach impacted roughly 3.9 million residents of Indiana and nearly 3 million people in Massachusetts.
“We knew back in 2019 that we could get a better deal for Hoosiers [residents of Indiana] than the amounts being discussed as part of the multistate settlement,” said Indiana Attorney General Curtis Hill. “In our own direct negotiations with Equifax representatives, we made sure to prioritize restitution payments for consumers affected by this preventable breach.”
Indiana says the full settlement amount will be used for restitution payments to affected consumers, minus the cost of managing those payments. Massachusetts says it will use part of the money “to support local consumer aid programs.”
Related: Equifax Ordered to Spend $1 Billion on Data Security Under Data Breach Settlement
Related: FTC Warns Cash Option May be Small for Equifax Settlement
Related: Chinese Military Hackers Charged Over Equifax Data Breach
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Zyxel Firewalls Hacked by Mirai Botnet
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations
- Zero-Day Vulnerability Exploited to Hack Barracuda Email Security Gateway Appliances
- OAuth Vulnerabilities in Widely Used Expo Framework Allowed Account Takeovers
- New Honeywell OT Cybersecurity Solution Helps Identify Vulnerabilities, Threats
- Rheinmetall Says Military Business Not Impacted by Ransomware Attack
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
