Equifax Data Breach Lawsuit: The $700 Million Settlement

The Breach

In 2017, hackers exploited an unpatched vulnerability in Equifax’s systems and, undetected for months, stole the personal information of about 147 million people — including names, dates of birth, and roughly 145 million Social Security numbers, plus some payment-card numbers. Because Equifax is a credit bureau that collects data on people who are not even its customers, the breach exposed information at the core of Americans’ financial identities.

Regulators faulted Equifax for failing to patch a known critical security flaw — a preventable lapse behind a catastrophic breach.

The Settlement

In 2019, Equifax agreed to a global settlement with the FTC, the CFPB and 50 states and territories of at least $575 million, and up to $700 million. It included a consumer fund of up to $425 million for people who spent time or money protecting themselves, with claims for reimbursed losses reaching up to $20,000, plus free credit monitoring. It was the largest data-breach settlement in US history at the time. Equifax did not admit wrongdoing.

Demand for the cash option was so high that per-person cash payments were reduced — a widely noted lesson about how thinly a large fund spreads across millions of claimants.

What Affected People Should Know

Given that nearly half of Americans were affected, a credit freeze at all three bureaus remains the strongest protection, and it is free. The Equifax claim windows have closed, but the episode is why free freezes and ongoing monitoring became standard advice. Treat any site still promising an Equifax payout as suspect.