Credit reporting bureau Equifax is finally starting to pay for the massive data breach it suffered in 2017 that exposed the personal information of more than 147 million Americans. In addition to a $700 million penalty issued by the Federal Trade Commission, Equifax has also reached a settlement on a class-action lawsuit that alleged the company failed to protect sensitive consumer data. The settlement is your chance to finally get something for all the trouble Equifax has caused. If your data was involved in the 2017 breach, you're eligible to claim free credit monitoring, cash, or potentially both if you also suffered damages.
What is the lawsuit against Equifax entail?
Following Equifax's data breach, a number of lawsuits were brought against the company on behalf of consumers who had personal information including Social Security numbers, dates of birth, and physical addresses exposed. Those lawsuits were effectively combined into a single case, which has been overseen by the U.S. District Court for the Northern District of Georgia.
Rather than go through the court proceedings, Equifax and the legal representatives for the class-action lawsuits went through a mediation process and came to a settlement. The agreement requires Equifax to pay out $380,500,000 (much of which has already been set aside) that will go into a so-called Consumer Restitution Fund, which will be used to pay people for losses and expenses incurred as a result of the Equifax breach.
It will also be used to cover the cost of credit monitoring services for victims of the breach, or to pay out money to those who would rather cash out than get credit protection. Unfortunately, the settlement does not require Equifax to admit any sort of guilt or wrongdoing despite a U.S. Housing Oversight Committee report calling the breach "entirely preventable" and hounding Equifax for lax security that led to the incident.
How do I know if I'm eligible to make a claim in the class-action lawsuit?
There's a website that has been set up to help you determine your eligibility — it's EquifaxBreachSettlement.com. Make sure that is the exact site that you visit, though, because there have already been a number of phishing sites set up and designed to trick you into surrendering your personal information — as if you haven't already been through enough of that with the Equifax breach in the first place.
There is a dedicated page on the Equifax Breach Settlement website that will help you determine if your data was included in the Equifax breach. Here's the slightly troubling part: The page that determines your eligibility requires you to enter your last name and the final six digits of your Social Security number. That might be uncomfortable information to give out, but it's how Equifax has determined it can best tell if you were involved in the breach. If your data was exposed, you'll receive a message that states, "Based on the information you provided, our records indicate your personal information was impacted by this incident." If you got that message, you can file a claim.
How do I file a claim?
The Equifax Breach Settlement website is designed to navigate you through filing a claim. There's a big button on the main page that takes you to the claim form and after you check your eligibility, you'll be presented with the option to file a claim. You can either file a claim online or chose to fill out and submit a physical form if you prefer. There's also a separate form for those who were minors at the time they were affected by the breach (that has to be filed via snail mail).
Once you've provided your information on the site, you can start to determine what you're going to get from Equifax: credit monitoring or cash? (You may be able to get both if you suffered any losses from the breach.) Your options will be laid out for you as you go through the claims process.
What type of compensation should I choose?
There are two choices that you can make as part of your claim. You can either take free credit monitoring, which applies to all three credit reporting bureaus for at least six months, or you can cash out and get up to $125 paid via check or pre-paid card. Based on the chatter online, most people are going for the cash. That's a totally understandable choice. It's money for nothing — save for having your personal information stolen and potentially exposing you to identity theft and other threats — and there are a lot of credit monitoring services out there that wouldn't cost you that much to sign up for.
Here's the catch with the cash, though. You'll be getting "up to" $125. That means it could be less. That figure, per the settlement, is based on a calculation of $31 million in cash claims. Divide that figure by the $125 pay out and you're looking at 248,000 people. If more than that many folks make their claim for cash, the amount of money you'll be getting will shrink with each additional person. If 500,000 file a claim, you'll get $62. If one million do it, you're down to $31. You can, to be fair, increase your cash total if you suffered any losses or spent time protecting yourself following the Equifax breach, but don't get too excited about that $125 figure.
Assuming you took the cash, you can expect your payment to arrive up to 90 days after the court provides its final approval for the settlement, which is expected to happen on December 19, 2019. Credit monitoring services should kick in on a similar timeline if you choose that option.
How do I get paid for time I spent protecting myself after the breach?
The next part of the claim form on the settlement website lets you get reimbursed for any time you spent recovering from having your information exposed. If you signed up for credit monitoring services, instituted a credit freeze, went through steps to defend against identity fraud or any other action following the Equifax breach, you can get paid back for it. Compensation is $25 per hour for up to 20 hours of time spent protecting yourself. You'll have to explain exactly how you spent this time and potentially provide documentation to prove you underwent efforts to protect yourself, so be ready for that.
Following that, you can also make claims for any losses or money spent as a result of the Equifax breach. That includes paying for different forms of protection and any losses suffered from having your personal information stolen. Once again, you'll need to provide documentation or this. You can claim up to $20,000 for losses or expenses.
How long do I have to file a claim?
You'll be able to file a claim as part of the settlement until January 22, 2020. That's the last day to file online and the postmark deadline for mailed submissions.
However, if there is somehow still money left in the Consumer Restitution Fund after all initial payments, there will be an extended claims period which will allow consumers to make claims for out-of-pocket losses and time spent protecting themselves. That extended deadline will run as long as January 22, 2024 and will be paid out on a first-come-first-served basis, but only if there's cash left in the Consumer Restitution Fund.
What if I don't file a claim?
If you choose not to file a claim against Equifax, it's essentially your loss. You'll gain nothing — no cash, no reimbursement for time or money spent and no credit monitoring services. Whether you make a claim or do nothing at all, you give up your right to take legal action against Equifax for anything relating to the 2017 data breach once the settlement becomes final. If you want to retain the right to sue Equifax, you'll have to as to be excluded entirely.
In order to get an exclusion, you'll have to mail a request for exclusion to the settlement administrator by November 19, 2019. That request must include the name of the proceeding, your full name, address, the words "Request for Exclusion" and your signature. You can find the full guide to exclusion and proper mailing address on the settlement website.