$125 Equifax compensation application now open

A further $500 is up for grabs under special circumstances

Equifax on phone

The FTC has launched a claim site where the victims of Equifax's catastrophic 2017 data breach can claim up to $125 in damages for having their social security numbers and other sensitive information leaked.

The site allows individuals to check if they were affected by the breach and also make a reimbursement claim by filling in a series of straightforward electronic forms.

Advertisement - Article continues below

A separate fund can also be applied for, a sum of up to $500 can be paid to individuals who had to spend their own time mitigating the effects of the breach, such as fighting identity fraud with banks. This is awarded at a rate of $25 per hour for a total of 20 hours.

Although the payout is higher, the application process its much more convoluted and requires a hefty amount of evidence. It's also far less likely to be applied for considering most people, at the time, weren't even aware their data had been leaked.

For the main compensation claim, victims can either choose a $125 check or pre-paid card, or free three-bureau credit monitoring. To be eligible for the claim you must already have credit monitoring and also keep it for a further six months after filing the claim.

Advertisement - Article continues below

Of the 146 million people affected by the breach, 15 million of them were British and it's not clear at this time whether UK victims can apply for the compensation on the same site. IT Pro has approached Equifax for clarification but it did not reply at the time of publication.

Advertisement - Article continues below

Affected individuals have until 22 January 2020 to make a claim and 19 November 2019 is the cut-off date for opting out of the compensation claim if someone wants to pursue their own case against Equifax.

22/07/2019: Equifax to shell out $700m in fines over 2017 breach

Equifax will pay up to $700 million to victims, regulators and US authorities following its catastrophic 2017 data breach, US federal trade commission officials have announced.

The settlement is split between the US government and the approximately 145 million US residents who were victims of the breach. However, there are some conditions attached to the payout for victims. The settlement obliges Equifax to contribute $300 million to a fund which will pay for credit monitoring services for affected US residents, and will also be used to reimburse victims for any identity theft protection they purchased, or other expenses incurred, as a result of the hack.

Equifax will supplement this fund with up to $125 million, depending on the amount of compensation required, and will also provide six free annual credit reports for the next seven years. It will also pay $100 million in civil penalties to the US Consumer Financial Protection Bureau, as well as $175 million to Puerto Rico, the District of Columbia and 48 US states.

Advertisement - Article continues below

The breach cost the company $1.4 billion, as of the company's latest financial results, a figure which, when combined with this latest round of penalties, rises to $2.1 billion. The Information Commissioner's Office has also previously hit Equifax with its maximum 500,000 fine over the 15 million UK residents who were affected by the breach.

Advertisement - Article continues below

This collection of financial reprimands, which represents the largest collection of fines and penalties in US data breach history, also comes with a scathing rebuke of Equifax's security practices. According to the FTC's complaint, "hackers were able to access a staggering amount of data because Equifax failed to implement basic security measures".

Its failure to segment its network, protect legacy databases or patch vulnerabilities in a timely manner (all while claiming to put reasonable safeguards in place) put Equifax in breach of the FTC Act and the Gramm-Leach-Bliley Act, the regulator said. Jun Ying, an ex-Equifax executive and the company's CIO at the time of the breach, was also sentenced to four months imprisonment for insider trading last month, after using his knowledge of the breach to dump his company shares before it was publicly announced.

Advertisement - Article continues below

On top of the requirements around penalties and compensation, the terms of Equifax's settlement also compel the company to institute sweeping changes of its security procedures. These include conducting annual security risk assessments, rolling out intrusion monitoring and patch management software, appointing a designated head of information security and making sure that any partners who access Equifax's stores of personal information also abide by similar security requirements. Its security program must also be assessed by an FTC-approved third party every two years.

"Companies that profit from personal information have an extra responsibility to protect and secure that data," FTC Chairman Joe Simons said as part of a statement. "Equifax failed to take basic steps that may have prevented the breach that affected approximately 147 million consumers."

"The incident at Equifax underscores the evolving cyber security threats confronting both private and government computer systems and actions they must take to shield the personal information of consumers," added Consumer Financial Protection Bureau Director Kathleen L. Kraninger. "Too much is at stake for the financial security of the American people to make these protections anything less than a top priority."

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now



University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020
ethical hacking

Mobile banking apps are exposing user data to attackers

26 Jun 2020

Most Popular

Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020

How to find RAM speed, size and type

24 Jun 2020

The road to recovery

30 Jun 2020