Two years after a major data breach exposed the personal information of around 147 million Americans, the credit bureau Equifax has agreed to pay at least $650 million to resolve consumer claims and multiple state and federal investigations stemming from the episode.
At least $300 million of that amount will go to consumers, according to settlement documents filed in federal court in Atlanta on Monday. Those affected by the breach could get an additional $125 million if the initial fund is exhausted. (Fines paid to state authorities and the Consumer Financial Protection Bureau account for most of the rest of the settlement amount.)
Individual victims may be able claim as much as $20,000 in compensation for losses resulting from the breach if they can prove they were harmed. Many details about how those affected can submit a claim, and what they may be entitled to, are hazy, but here’s what we know so far.
Who will be eligible for compensation?
The 147 million Americans whose personal information was compromised in the breach are covered by the settlement. Those who can prove they have been fraud victims will be entitled to relief if the settlement’s administrator determines that their losses are “fairly traceable” to the Equifax breach. People who have not been fraud victims but who spent a significant amount of time taking precautions to protect their identities are also covered.
How do you apply for compensation?
Consumers must submit claims, with documentation, that prove they lost money as a result of fraud or spent money on credit-monitoring services.
After the settlement receives court approval, a new website will be created to handle claims. In the meantime, consumers can get updates on the settlement process at ftc.gov/equifax.
How much money might you receive?
There is little evidence that the breach actually led to fraud, making it difficult to determine how badly consumers may have been harmed.
But Equifax has agreed to provide up to 10 years of free credit-monitoring services to breach victims. Consumers will also be compensated for time spent taking preventive measures or dealing with identity theft, at a rate of $25 an hour for up to 20 hours.
They can also be reimbursed for up to $20,000 in losses that are “fairly traceable” to the breach, the settlement says, including the cost of freezing or unfreezing a credit file and buying credit-monitoring services, as well as fraud and identity theft.
Once the settlement is approved, consumers will have six months to claim any benefits. But an extended claims period of four years will allow consumers to recover losses that occur after the initial window closes if there is money left in the fund.
What led to the settlement?
In 2017, Equifax said hackers stole sensitive information, including Social Security and driver’s license numbers, belonging to millions of its customers in one of the most significant data breaches in history. The breach took Equifax more than two months to detect, government investigators later discovered, and the company waited more than a month to inform the public. The hackers involved in the episode have never been identified.
Stacy Cowley contributed reporting.