The FTC has launched a claim site where the victims of Equifax's catastrophic 2017 data breach can claim up to $125 in damages for having their social security numbers and other sensitive information leaked.
The site allows individuals to check if they were affected by the breach and also make a reimbursement claim by filling in a series of straightforward electronic forms.
A separate fund can also be applied for, a sum of up to $500 can be paid to individuals who had to spend their own time mitigating the effects of the breach, such as fighting identity fraud with banks. This is awarded at a rate of $25 per hour for a total of 20 hours.
Although the payout is higher, the application process its much more convoluted and requires a hefty amount of evidence. It's also far less likely to be applied for considering most people, at the time, weren't even aware their data had been leaked.
For the main compensation claim, victims can either choose a $125 check or pre-paid card, or free three-bureau credit monitoring. To be eligible for the claim you must already have credit monitoring and also keep it for a further six months after filing the claim.
Of the 146 million people affected by the breach, 15 million of them were British and it's not clear at this time whether UK victims can apply for the compensation on the same site. IT Pro has approached Equifax for clarification but it did not reply at the time of publication.
Affected individuals have until 22 January 2020 to make a claim and 19 November 2019 is the cut-off date for opting out of the compensation claim if someone wants to pursue their own case against Equifax.
22/07/2019: Equifax to shell out $700m in fines over 2017 breach
Equifax will pay up to $700 million to victims, regulators and US authorities following its catastrophic 2017 data breach, US federal trade commission officials have announced.
The settlement is split between the US government and the approximately 145 million US residents who were victims of the breach. However, there are some conditions attached to the payout for victims. The settlement obliges Equifax to contribute $300 million to a fund which will pay for credit monitoring services for affected US residents, and will also be used to reimburse victims for any identity theft protection they purchased, or other expenses incurred, as a result of the hack.
Equifax will supplement this fund with up to $125 million, depending on the amount of compensation required, and will also provide six free annual credit reports for the next seven years. It will also pay $100 million in civil penalties to the US Consumer Financial Protection Bureau, as well as $175 million to Puerto Rico, the District of Columbia and 48 US states.
The breach cost the company $1.4 billion, as of the company's latest financial results, a figure which, when combined with this latest round of penalties, rises to $2.1 billion. The Information Commissioner's Office has also previously hit Equifax with its maximum 500,000 fine over the 15 million UK residents who were affected by the breach.
This collection of financial reprimands, which represents the largest collection of fines and penalties in US data breach history, also comes with a scathing rebuke of Equifax's security practices. According to the FTC's complaint, "hackers were able to access a staggering amount of data because Equifax failed to implement basic security measures".
Its failure to segment its network, protect legacy databases or patch vulnerabilities in a timely manner (all while claiming to put reasonable safeguards in place) put Equifax in breach of the FTC Act and the Gramm-Leach-Bliley Act, the regulator said. Jun Ying, an ex-Equifax executive and the company's CIO at the time of the breach, was also sentenced to four months imprisonment for insider trading last month, after using his knowledge of the breach to dump his company shares before it was publicly announced.
On top of the requirements around penalties and compensation, the terms of Equifax's settlement also compel the company to institute sweeping changes of its security procedures. These include conducting annual security risk assessments, rolling out intrusion monitoring and patch management software, appointing a designated head of information security and making sure that any partners who access Equifax's stores of personal information also abide by similar security requirements. Its security program must also be assessed by an FTC-approved third party every two years.
"Companies that profit from personal information have an extra responsibility to protect and secure that data," FTC Chairman Joe Simons said as part of a statement. "Equifax failed to take basic steps that may have prevented the breach that affected approximately 147 million consumers."
"The incident at Equifax underscores the evolving cyber security threats confronting both private and government computer systems and actions they must take to shield the personal information of consumers," added Consumer Financial Protection Bureau Director Kathleen L. Kraninger. "Too much is at stake for the financial security of the American people to make these protections anything less than a top priority."
