On April 14, 2020, Indiana Attorney General Curtis Hill announced that the state had reached a $19.5 million settlement with Equifax to resolve the state’s claims related to the 2017 data breach that affected nearly 148 million consumers, including 3.9 million Indiana residents. In May 2019, Indiana elected to bring its own action against Equifax, opting out of multi-state litigation that resulted in settlements concluded in July 2019 with 48 states, Puerto Rico, the District of Columbia and the New York Department of Financial Services. The multi-state settlement established a $425 million restitution fund for credit monitoring and loss reimbursement, plus a $175 million payment to the states. According to the Indiana AG’s Office, the $19.5 million settlement exceeds the amount that any other individual state received in the multi-state litigation.
Under both the Indiana and the multi-state settlements, Equifax must comply with similar security practices such as complying with the Information Security Program, a comprehensive set of rules requiring regular monitoring, reporting and testing of Equifax’s network systems. Equifax is also required to minimize the collection and storage of social security numbers and other sensitive data according to both agreements. Regarding consumer entitlements, all who are affected are entitled to 10 years of free credit monitoring, $1 million in identity theft insurance, free placement and removal of credit freezes and unfreezes, and 18 years of free credit monitoring for any victims who were under 18 years of age at the time of the breach. However, Indiana consumers are entitled to a few extras, for example, they receive 2 free credit reports every 12 months until the end of 2024, and they are entitled to an Escalated Identity Theft Block Process that allows the Indiana AG’s Office to escalate matters within Equifax in the event the company fails to block potentially fraudulent information on Indiana consumers’ credit reports.
In a press statement announcing the settlement, Attorney General Hill said, “We knew back in 2019 that we could get a better deal for Hoosiers than the amounts being discussed as part of the multistate settlement. …In our own direct negotiations with Equifax representatives, we made sure to prioritize restitution payments for consumers affected by this preventable breach.” According to Hill, after subtracting costs for processing payments, the full $19.5 million will be used to pay restitution to Indiana consumers affected by the breach.
Indiana Attorney General Press Release | Equifax Indiana Settlement | 2019 DC Attorney General Press Release | 2019 Equifax Multi-State Settlement