Holding Equifax Accountable: Lawsuits and Actions Against Equifax

The Equifax breach has, rightly so, been a heat magnet for the credit reporting giant in the media. It’s also been a lawsuit magnet as the company has faced a tremendous number of suits against it in the last several weeks.

A few days ago, we discussed the common causes of action that may be available to you for holding Equifax legally accountable if you’ve been affected by the recent hacks stealing a tremendous amount of private consumer information–everything from social security numbers to credit card numbers and more. It would hardly be surprising if you can count yourself among this unfortunate number as the hack impacted nearly half the population of the United States.

With this many affected, it’s no surprise that there have been a veritable landslide of lawsuits and actions brought against Equifax recently. From class actions to more specific cases to government action against the credit behemoth–let’s look at the many ways people are trying to hold Equifax accountable for this breach.

What is a Class Action Lawsuit?

Class action lawsuits are common when many would-be plaintiffs have damages which are individually too small to justify the costs of a lawsuit. They are not always easy to bring, having several requirements such as similarly situated plaintiffs before they can be approved. However, with half the nation affected by Equifax’s breach there are a heck of a lot of people with smaller claims. This has led to over 50 different class action lawsuits being leveled against Equifax, some of these lawsuits seek as much as $70B.

These lawsuits primarily deal with the two causes of action we discussed earlier this week–Federal Credit Reporting Act (FCRA) violations and negligence. This is because these can take the individually small claims–especially when it comes to FCRA violations–and combine to make a lawsuit that can support its costs.

However, not all of these class actions deal with FCRA and negligence issues. For instance, one of the lawsuits seeking to be certified as a class action is made up entirely of banks and financial institutions. The lawsuit argues that the breach is forcing these banks to pay for canceling and reissuing credit cards and costing them profits as customers are prevented from or become wary of using credit cards after Equifax’s breach.

What about Private Lawsuits Against Equifax?

Lawsuits brought against Equifax by individuals have covered even more types of legal claims than their class action counterparts.

A lawsuit out of San Jose has targeted Equifax’s offer of a year of free credit monitoring, arguing that the move is designed to transition into paid services. Another lawsuit out of Atlanta is accusing Equifax of securities fraud for knowingly misleading shareholders as to their ability to protect the privacy of consumer data.

Carson Block–best known for alleging fraudulent activity on the part of companies then profiting off short-selling that company as their stock collapses–was himself a victim of the Equifax breach. With his data and social security number stolen, he has sued for $500,000 over negligence and the “stress, nuisance, and annoyance” of dealing with his lost data.

Private persons are not alone in their actions against Equifax. Lawsuits have been brought over the breach by the city of San Francisco and the State of Massachusetts.  These lawsuits seek millions of dollars in civil penalties and restitution for consumers out of the city and state.

The FTC, SEC, and More Taking Official Action

While Massachusetts and San Francisco are bringing lawsuits against Equifax, the Federal Trade Commission (FTC), the Securities and Exchange Commission, the FBI, Congress, the Consumer Federal Protection Bureau, and the Attorney Generals for over 40 states have begun investigations into Equifax and the Equifax breach.

Obviously, each of these investigations will take their own path and most are remaining tight lipped about the actual investigations. For instance, the FTC mentioned that–while it usually does not comment on ongoing investigations whatsoever–it would confirm the existence of an investigation considering the sheer number of people in the U.S. that were impacted by the breach. The FTC investigation will be focusing on Equifax’s security measures and their handling of customer service once the breach was announced.

How Will This Resolve?

With so many lawsuits with so many different fact patterns, it’s obviously extremely hard to predict results. However, at least for class action lawsuits on this sort of issue, there is an unfortunate trend of settling for extremely small individual payouts for members of a class action lawsuit–often settling for free credit monitoring services and nothing more.

Some have predicted that this case will be a bit different. Judges have become more hesitant to sign off on settlements that only provide free credit monitoring–especially since there is a trend for the free credit monitoring provided to transition into proposals for paid services. What’s more, as mentioned in the article earlier this week there has been a move towards courts recognizing a breach itself as a recognizable harm as opposed to requiring that breach to result in actual financial damages. This opens the doors to a sea of new potential plaintiffs.

This is all true, however, we will likely be waiting at least a few years before we see any actual resolution on these cases–especially the class actions. These class action cases need to go through a lot of initial steps which will substantially slow the process. What’s more, given the sheer number of people effected, it will take a truly monumental payout for individual members of a class action to see a substantial recovery. With half the U.S. affected, if Equifax settled for $5B the average harmed consumer could expect to see around $35 if everybody took their share.

Regardless of the end results, it is crucial that we hold companies such as Equifax–companies who hold information capable of ruining somebody financially–accountable for their data security. This can be done by lawsuits targeting their pocket book. However, it needs to also be done at a regulatory level in Congress. Congress actions just days ago, shooting down laws making it harder for companies to insulate against class action lawsuits, have not fit this bill. For now, we can only hope more regulations will be put forward and this time Congress will be more receptive.