On January 13, 2020, the United States District Court for the Northern District of Georgia granted the plaintiffs’ motion for final approval of a class action settlement with Equifax Inc. The court had granted preliminary approval of the settlement in July 2019.
The settlement resolves claims arising out of a cyberattack and data breach announced by Equifax Inc. on September 7, 2017 that affected 147 million US consumers and resulted in the filing of over 300 class actions against the three relevant Equifax entities. The cases were consolidated and transferred to the Northern District of Georgia, which established separate tracks for claims by consumers and claims by financial institutions.
The terms of the settlement include an initial payment of $380,500,000 into a fund for class benefits, attorneys’ fees and expenses, plus a commitment of an additional $125,000,000 for class member out-of-pocket losses if the initial $380,500,000 is insufficient to cover class benefit. Class benefits include reimbursement up to $20,000 for documented out-of-pocket losses, compensation up to 20 hours at $25/hour for time spent preventing or remediating identify theft from the breach, 4-10 years of credit monitoring, and identity restoration services. Equifax’ financial commitment could grow an additional $2 billion if all class members elect to sign up for credit monitoring.
In addition, Equifax has agreed to spend a minimum of $1 billion over five years for data security, and follow a comprehensive data security compliance program to be audited by an independent assessor.
The settlement concludes the consumer track of the consolidated litigation; a settlement with the financial institutions remains pending, and on January 15, 2020, the parties filed a joint motion to set a schedule regarding the financial institutions’ complaint.