Equifax pays Indiana $19.5m to settle data breach case

Consumer credit reporting company Equifax has shelled out $19.5m to settle a class-action lawsuit brought by the State of Indiana.

The Hoosier State filed the suit against Equifax after a major data breach at the organization exposed the personal information of over half of all Americans, including 3.9 million Indiana residents. 

Between May and June of 2017, threat actors exploited an unpatched Apache Struts vulnerability to gain access to the personal information of around 150 million Equifax customers, about 56% of Americans. Information illegally accessed and copied by the cyber-criminals included highly sensitive financial data, driver's license numbers, and Social Security numbers.

Equifax discovered that a breach had occurred in July 2019. The company neglected to disclose the major cyber-incident until close of trading six weeks later. 

Indiana's suit was brought by the state's attorney general, Curtis Hill. In it, Equifax is accused of failing to adequately protect the state's residents' private information. 

Under the terms of the settlement, in addition to paying Indiana $19.5m, Equifax must resolve any lingering cybersecurity issues and take action to safeguard information against future cyber-attacks. 

Indiana is one of only two states that opted not to participate in a multi-state suit brought against Equifax following the catastrophic breach. This jointly brought suit was settled in July 2019 for the eye-watering sum of $700m with the US Federal Trade Commission, Consumer Financial Protection Bureau, and 48 states and te ..

Support the originator by clicking the read the rest link below.