Massachusetts and Indiana, the only two U.S. states that independently sued Equifax over the massive data breach that occurred in 2017, have settled with the credit reporting agency for a total of close to $40 million.
The Equifax data breach affected roughly 147 million people. Hackers gained access to information such as social security numbers, dates of birth, driver license numbers, payment card numbers and even passport information. The U.S. government has charged four members of the Chinese People’s Liberation Army (PLA) for their role in the cyberattack.
Following the incident, Equifax was sued by both consumers and authorities over its failure to protect sensitive personal information, including by the Federal Trade Commission (FTC), the Consumer Financial Protection Bureau (CFPB), and 50 states.
As part of a settlement approved in January, Equifax will have to set aside $380 million for payments to affected individuals, attorney fees of $80 million, and other costs. The states that filed a lawsuit against the company will receive a total of $175 million.
However, Massachusetts and Indiana are not included in that multistate settlement as they filed their own lawsuits against Equifax. The attorneys general of Massachusetts and Indiana announced last week that they have each reached a settlement with the company for $18.2 million and $19.5 million, respectively.
The Equifax breach impacted roughly 3.9 million residents of Indiana and nearly 3 million people in Massachusetts.
“We knew back in 2019 that we could get a better deal for Hoosiers [residents of Indiana] than the amounts being discussed as part of the multistate settlement,” said Indiana Attorney General Curtis Hill. “In our own direct negotiations with Equifax representatives, we made sure to prioritize restitution payments for consumers affected by this preventable breach.”
Indiana says the full settlement amount will be used for restitution payments to affected consumers, minus the cost of managing those payments. Massachusetts says it will use part of the money “to support local consumer aid programs.”
Related: Equifax Ordered to Spend $1 Billion on Data Security Under Data Breach Settlement
Related: FTC Warns Cash Option May be Small for Equifax Settlement
Related: Chinese Military Hackers Charged Over Equifax Data Breach
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- In Other News: AI Regulation, Layoffs, US Aerospace Attacks, Post-Quantum Encryption
- Evidence Suggests Ransomware Group Knew About MOVEit Zero-Day Since 2021
- Vulnerabilities in Honda eCommerce Platform Exposed Customer, Dealer Data
- Barracuda Urges Customers to Replace Hacked Email Security Appliances
- Google Patches Third Chrome Zero-Day of 2023
- ChatGPT Hallucinations Can Be Exploited to Distribute Malicious Code Packages
- AntChain, Intel Create New Privacy-Preserving Computing Platform for AI Training
- Several Major Organizations Confirm Being Impacted by MOVEit Attack
Latest News
- In Other News: AI Regulation, Layoffs, US Aerospace Attacks, Post-Quantum Encryption
- Blackpoint Raises $190 Million to Help MSPs Combat Cyber Threats
- Google Introduces SAIF, a Framework for Secure AI Development and Use
- ‘Asylum Ambuscade’ Group Hit Thousands in Cybercrime, Espionage Campaigns
- Evidence Suggests Ransomware Group Knew About MOVEit Zero-Day Since 2021
- SaaS Ransomware Attack Hit Sharepoint Online Without Using a Compromised Endpoint
- Google Cloud Now Offering $1 Million Cryptomining Protection
- Democrats and Republicans Are Skeptical of US Spying Practices, an AP-NORC Poll Finds
