$125 Equifax compensation application now open

A further $500 is up for grabs under special circumstances

Equifax on phone

The FTC has launched a claim site where the victims of Equifax's catastrophic 2017 data breach can claim up to $125 in damages for having their social security numbers and other sensitive information leaked.

The site allows individuals to check if they were affected by the breach and also make a reimbursement claim by filling in a series of straightforward electronic forms.

Advertisement - Article continues below

A separate fund can also be applied for, a sum of up to $500 can be paid to individuals who had to spend their own time mitigating the effects of the breach, such as fighting identity fraud with banks. This is awarded at a rate of $25 per hour for a total of 20 hours.

Although the payout is higher, the application process its much more convoluted and requires a hefty amount of evidence. It's also far less likely to be applied for considering most people, at the time, weren't even aware their data had been leaked.

For the main compensation claim, victims can either choose a $125 check or pre-paid card, or free three-bureau credit monitoring. To be eligible for the claim you must already have credit monitoring and also keep it for a further six months after filing the claim.

Advertisement - Article continues below

Of the 146 million people affected by the breach, 15 million of them were British and it's not clear at this time whether UK victims can apply for the compensation on the same site. IT Pro has approached Equifax for clarification but it did not reply at the time of publication.

Advertisement - Article continues below

Affected individuals have until 22 January 2020 to make a claim and 19 November 2019 is the cut-off date for opting out of the compensation claim if someone wants to pursue their own case against Equifax.

22/07/2019: Equifax to shell out $700m in fines over 2017 breach

Equifax will pay up to $700 million to victims, regulators and US authorities following its catastrophic 2017 data breach, US federal trade commission officials have announced.

The settlement is split between the US government and the approximately 145 million US residents who were victims of the breach. However, there are some conditions attached to the payout for victims. The settlement obliges Equifax to contribute $300 million to a fund which will pay for credit monitoring services for affected US residents, and will also be used to reimburse victims for any identity theft protection they purchased, or other expenses incurred, as a result of the hack.

Equifax will supplement this fund with up to $125 million, depending on the amount of compensation required, and will also provide six free annual credit reports for the next seven years. It will also pay $100 million in civil penalties to the US Consumer Financial Protection Bureau, as well as $175 million to Puerto Rico, the District of Columbia and 48 US states.

Advertisement - Article continues below

The breach cost the company $1.4 billion, as of the company's latest financial results, a figure which, when combined with this latest round of penalties, rises to $2.1 billion. The Information Commissioner's Office has also previously hit Equifax with its maximum 500,000 fine over the 15 million UK residents who were affected by the breach.

Advertisement - Article continues below

This collection of financial reprimands, which represents the largest collection of fines and penalties in US data breach history, also comes with a scathing rebuke of Equifax's security practices. According to the FTC's complaint, "hackers were able to access a staggering amount of data because Equifax failed to implement basic security measures".

Its failure to segment its network, protect legacy databases or patch vulnerabilities in a timely manner (all while claiming to put reasonable safeguards in place) put Equifax in breach of the FTC Act and the Gramm-Leach-Bliley Act, the regulator said. Jun Ying, an ex-Equifax executive and the company's CIO at the time of the breach, was also sentenced to four months imprisonment for insider trading last month, after using his knowledge of the breach to dump his company shares before it was publicly announced.

Advertisement - Article continues below

On top of the requirements around penalties and compensation, the terms of Equifax's settlement also compel the company to institute sweeping changes of its security procedures. These include conducting annual security risk assessments, rolling out intrusion monitoring and patch management software, appointing a designated head of information security and making sure that any partners who access Equifax's stores of personal information also abide by similar security requirements. Its security program must also be assessed by an FTC-approved third party every two years.

"Companies that profit from personal information have an extra responsibility to protect and secure that data," FTC Chairman Joe Simons said as part of a statement. "Equifax failed to take basic steps that may have prevented the breach that affected approximately 147 million consumers."

"The incident at Equifax underscores the evolving cyber security threats confronting both private and government computer systems and actions they must take to shield the personal information of consumers," added Consumer Financial Protection Bureau Director Kathleen L. Kraninger. "Too much is at stake for the financial security of the American people to make these protections anything less than a top priority."

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now



10 quick tips to identifying phishing emails

16 Mar 2020
mergers and acquisitions

Panda Security to be acquired by WatchGuard

9 Mar 2020
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular


Zoom kills Facebook integration after data transfer backlash

30 Mar 2020
Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020
data breaches

Marriott data breach exposes personal data of 5.2 million guests

31 Mar 2020
cyber crime

FBI warns of ‘Zoom-bombing’ hackers amid coronavirus usage spike

31 Mar 2020