Skip to main content

Equifax Sued Over Data Breach -- Again

By William Vogeler, Esq. on May 13, 2019

Indiana has filed suit against Equifax, adding to lawsuits already pending against the company for one of the biggest data breaches in history.

The 2017 breach affected some 148 million Americans, but it's impact has reached much further. That's because Equifax is the world's largest credit-reporting bureau and has personal and financial information on everyone in its database. Equifax is already fighting a consolidated class-action, but the Indiana case puts another dagger in the company's back. Along with government investigations, the company definitely has a poor credit-bureau history.

A Poor History

Attorney General Curtis Hill says the data breach affected 3.9 million Indianans. In the lawsuit, he says Equifax CEO Richard Smith chose profits over consumer protection. The company allegedly acquired other companies, at the same time outsourcing and under-staffing in ways that violated industry standards.

The complaint says Equifax continues to ignore Payment Card Industry stands, leaving the company's operations vulnerable to exposure. The lawsuit also cites a federal government investigation that concluded Equifax could have prevented the breach.

Indiana falls in line with a consolidated class-action pending in Atlanta. Earlier this year, a federal court there denied the company's motion to dismiss the case. The judge said it is clear "the company owed a duty to protect consumers' information from a data breach." The case is moving slowly, given many claims were filed in late 2017 and the matter had not yet been certified as a class-action by the end of 2018.

Consumer Protection

Meanwhile, individuals have sued successfully in small claims courts. Christian Haigh, writing for Law2.0, explained how he won $8,000 from the company. He was surprised when a company representative appeared in court to oppose him.

It helped that Haigh informed the judge about Equifax executives who cashed out stock after learning about the data breach and before making it known to the public. The opposing counsel didn't have much of an explanation. The judge took it under submission. The process took more than 30 days, which is the small claims version of the Speedy Trial Act in California, because Equifax delayed. Finally, the judge awarded Haigh damages for creditor monitoring, emotional distress, and punitive damages.

Not the typical small claims judgment, but still a win -- a lot faster than a class-action or the state of Indiana.

Related Resources:

Copied to clipboard