Cybersecurity Policy Report, $575M Equifax Settlement Leads to Calls for Legislation, (Jul 22, 2019)

By Tom Leithauser

Equifax, Inc., has agreed to pay at least $575 million, and possibly as much as $700 million, as part of a global settlement with the Federal Trade Commission, the Consumer Financial Protection Bureau (CFPB), and 50 U.S. states and territories, which alleged that the credit reporting agency's failure to take reasonable steps to secure its network led to a data breach in 2017 that affected about 147 million people.

In its complaint, the FTC alleged that Equifax failed to secure the massive amount of personal information stored on its network, leading to a breach that exposed millions of names, dates of birth, Social Security numbers, physical addresses, and other personal information that could lead to identity theft and fraud.

As part of the proposed settlement, the credit reporting agency (CRA) will pay $300 million to a fund that will provide affected consumers with credit monitoring services. The fund will also compensate consumers who bought credit or identity monitoring services from Equifax and paid other out-of-pocket expenses as a result of the 2017 data breach.

Equifax will contribute additional money, up to $125 million, to the fund if the initial payment is inadequate to compensate consumers for their losses. The company also has agreed to pay $175 million to 48 states, the District of Columbia and Puerto Rico, as well as $100 million to the CFPB in civil penalties.

The settlement, criticized by some for taking too long to reach and for being insufficient to adequately penalize Equifax, led to calls from policy-makers for legislative changes to better protect consumers and deter companies in data breach cases.

"I want to flag an important aspect of this settlement, and a key message for Congress," FTC Chairman Joseph Simons said. "The CFPB and the states were able to obtain civil penalties for this massive breach by a major financial institution. The FTC could not, because we do not have civil penalty authority for initial violations of the FTC Act or for violations of the Gramm-Leach-Bliley Safeguards Rule."

"Fortunately, other agencies were able to fill in the gap this time. But under different circumstances, future breaches might not always be subject to civil penalties, which sends absolutely the wrong signal regarding deterrence. For this reason, I renew my call for Congress to enact federal data security legislation that gives the FTC authority to seek civil penalties for first-time violations," Mr. Simons said.

Sens. Mark R. Warner (D., Va.), Ron Wyden (D., Ore.), Ed Markey (D., Mass.), and Amy Klobuchar (D., Minn.) all released statements calling for new laws to better protect consumers and penalize companies that fail to protect personal data.

"Americans don't choose to have companies like Equifax collecting their data -- by the nature of their business models, credit bureaus collect your personal information whether you want them to or not," Sen. Warner said. "In light of that, the penalties for failing to secure that data should be appropriately steep."

"While I'm happy to see that customers who have been harmed as a result of Equifax's shoddy cybersecurity practices will see some compensation, we need structural reforms and increased oversight of credit reporting agencies in order to make sure that this never happens again," Sen. Warner added.

He noted he had introduced, with Sen. Elizabeth Warren (D., Mass.), the Data Breach Prevention and Compensation Act (S 1336), which he said "would provide robust compensation to consumers for stolen data, impose mandatory penalties on CRAs for data breaches, and give the Federal Trade Commission (FTC) more direct supervisory authority over data security at CRAs."

Sen. Markey said he planned to reintroduce the Data Broker Accountability and Transparency Act, which would enable consumers to access and correct their information to help ensure accuracy and would give consumers the right to stop data brokers from using, sharing, or selling their personal information for marketing purposes.

"For years, Equifax compiled dossiers on American consumers on a massive scale and then played fast and loose with that data," Sen. Markey said. "The ensuing data breach wreaked havoc on consumers' security and well-being and shed light on the need to regulate this 'shadow' industry of surreptitious data collection. This settlement is far from an adequate solution to our society's data broker problem, and we have to do much more to stop the next breach before it happens."

The 2017 data breach at Equifax resulted from the company's failure to fully patch a web application development tool known as Apache Struts, giving hackers a 76-day window to steal private data and network access credentials that were stored in plain text.

The FTC alleged that Equifax violated the FTC Act by misleading consumers into believing it had implemented strong network security measures and the Gramm-Leach-Bliley Act's Safeguards Rule, which requires financial institutions to develop, implement, and maintain a comprehensive information security program to protect the security, confidentiality, and integrity of customer information.

In addition to the FTC and CFPB's penalties, the Equifax global settlement attempts to resolve multi-jurisdiction class-action lawsuits and lawsuits filed by attorneys general from 50 states and U.S. territories: Alabama, Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, Florida, Georgia, Hawaii, Idaho, Illinois, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, Wyoming, the District of Columbia, and Puerto Rico.

"Equifax put profits over privacy and greed over people, and must be held accountable to the millions of people they put at risk," said New York Attorney General Letitia James, who co-led the state effort to obtain restitution.

"This company's ineptitude, negligence, and lax security standards endangered the identities of half the U.S. population. Now it's time for the company to do what's right and not only pay restitution to the millions of victims of their data breach, but also provide every American who had their highly sensitive information accessed with the tools they need to battle identity theft in the future," Ms. James said.

Equifax Chief Executive Officer Mark Begor, who became the company's CEO nearly a year after the breach was discovered, described the settlement as "a positive step for U.S. consumers and Equifax as we move forward from the 2017 cybersecurity incident and focus on our transformation investments in technology and security as a leading data, analytics, and technology company."

"The consumer fund of up to $425 million that we are announcing today reinforces our commitment to putting consumers first and safeguarding their data -- and reflects the seriousness with which we take this matter. We have been committed to resolving this issue for consumers and have the financial capacity to manage the settlement while continuing our $1.25 billion EFX2020 technology and security investment program. We are focused on the future of Equifax and returning to market leadership and growth," Mr. Begor said.

The settlement also requires Equifax to take several steps to improve its network security and protect consumers who were harmed, including providing all U.S. consumers with six free credit reports each year for seven years in addition to the one free annual credit report that Equifax and the two other nationwide credit reporting agencies currently provide.

Additionally, Equifax would provide free credit-monitoring services for up to 10 years for victims of the data breach and would make it easier for those victims to freeze and unfreeze their credit and dispute inaccurate information in credit reports.

The settlement also requires the company to designate a chief security officer who will report regularly to the board of directors, conduct regular exercises to test its network security posture, and encrypt personal information stored on its systems.

The settlement with the FTC, CFPB, and attorneys general is subject to approval by the U.S. District Court for the Northern District of Georgia, while settlements of the class-action lawsuits will be overseen by the various courts in which those cases were filed.

MainStory: Cybersecurity Privacy DataBreach