Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Massachusetts, Indiana Settle With Equifax Over 2017 Data Breach

Massachusetts and Indiana, the only two U.S. states that independently sued Equifax over the massive data breach that occurred in 2017, have settled with the credit reporting agency for a total of close to $40 million.

Massachusetts and Indiana, the only two U.S. states that independently sued Equifax over the massive data breach that occurred in 2017, have settled with the credit reporting agency for a total of close to $40 million.

The Equifax data breach affected roughly 147 million people. Hackers gained access to information such as social security numbers, dates of birth, driver license numbers, payment card numbers and even passport information. The U.S. government has charged four members of the Chinese People’s Liberation Army (PLA) for their role in the cyberattack.

Following the incident, Equifax was sued by both consumers and authorities over its failure to protect sensitive personal information, including by the Federal Trade Commission (FTC), the Consumer Financial Protection Bureau (CFPB), and 50 states.

As part of a settlement approved in January, Equifax will have to set aside $380 million for payments to affected individuals, attorney fees of $80 million, and other costs. The states that filed a lawsuit against the company will receive a total of $175 million.

However, Massachusetts and Indiana are not included in that multistate settlement as they filed their own lawsuits against Equifax. The attorneys general of Massachusetts and Indiana announced last week that they have each reached a settlement with the company for $18.2 million and $19.5 million, respectively.

The Equifax breach impacted roughly 3.9 million residents of Indiana and nearly 3 million people in Massachusetts.

“We knew back in 2019 that we could get a better deal for Hoosiers [residents of Indiana] than the amounts being discussed as part of the multistate settlement,” said Indiana Attorney General Curtis Hill. “In our own direct negotiations with Equifax representatives, we made sure to prioritize restitution payments for consumers affected by this preventable breach.”

Indiana says the full settlement amount will be used for restitution payments to affected consumers, minus the cost of managing those payments. Massachusetts says it will use part of the money “to support local consumer aid programs.”

Advertisement. Scroll to continue reading.

Related: Equifax Ordered to Spend $1 Billion on Data Security Under Data Breach Settlement

Related: FTC Warns Cash Option May be Small for Equifax Settlement

Related: Chinese Military Hackers Charged Over Equifax Data Breach

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how to utilize tools, controls, and design models needed to properly secure cloud environments.

Register

Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Register

People on the Move

SaaS security company AppOmni has hired Joel Wallenstrom as its General Manager.

FTI Consulting has appointed Brett Callow as Managing Director in its Cybersecurity & Data Privacy Communications practice.

Mobile security firm Zimperium has welcomed David Natker as its VP of Global Partners and Alliances.

More People On The Move

Expert Insights