Equifax agrees to massive payout for data breach

The credit reporting bureau Equifax has agreed to pay $700 million and potentially more to the U.S. government and to states over a 2017 data breach that exposed the Social Security numbers and private information of nearly 150 million Americans. Under the settlement, Equifax will initially pay nearly $400 million into a special fund to cover costs related to potential identity theft and other damages. The company’s total payout could dramatically increase from there, potentially into the billions. It will have to spend at least $1 billion over five years to bolster its cybersecurity practices.

“This settlement requires significant corporate change,” Pennsylvania Attorney General Josh Shapiro said Monday. “And we send a clear message to corporate America that attorneys general are going to hold companies accountable for being irresponsible with Americans’ data.”

Affected consumers may be eligible to receive money if they paid to protect or monitor their credit after the breach. All affected consumers can get free credit monitoring for 10 years and at least seven years of free identity restoration services. Starting at the end of this year, all U.S. shoppers may request up to six free copies of their Equifax credit report during any 12-month period. Affected persons who don’t take advantage of free credit services may seek up to $125 reimbursement.