Equifax’s massive data breach in 2017 compromised 146.6 million Social Security numbers along with other personal information. As a result, the consumer credit reporting agency faced numerous lawsuits, including a class-action lawsuit that reached a settlement of at least $650 million on Monday.
According to the terms of the settlement, which still requires court approval, Equifax has to put at least $380.5 million into a restitution fund for consumers harmed by the breach. The credit-monitoring agency has agreed to put up an additional $125 million if consumers’ out-of-pocket losses exceed $380.5 million.
The settlement also includes money Equifax will spend on free credit monitoring for those affected by the breach.
The roughly 147 million people whose data was breached are eligible for five potential benefits.
They can be compensated for up to 20 hours at $25 per hour for time they spent dealing with identity theft or other related measures. Ten of these hours can be “self-certified.”
They are also eligible to be reimbursed for up to $20,000 as a result of losses “fairly traceable” to the breach. This can include a credit file being frozen or unfrozen, buying credit monitoring services, out-of-pocket losses due to identity theft of fraud, and a quarter of money paid to Equifax for credit monitoring or ID theft protection subscriptions a year before the breach.
As a result of the settlement, class members can obtain four years of three-bureau credit monitoring and ID protection through Experian — worth $1,200. Plus, they can get another six years of one-bureau credit monitoring through Equifax, valued at $720.
Consumers who have existing credit-card monitoring can be paid $125.
The settlement also provides “ID restoration” services for seven years, for those who were victims of identity theft. These consumers will be assigned an “identity theft restoration specialist” who will provide them with step-by-step assistance.
"This comprehensive settlement is a positive step for U.S. consumers and Equifax as we move forward from the 2017 cybersecurity incident and focus on our transformation investments in technology and security as a leading data, analytics, and technology company," Equifax CEO Mark W. Begor said in the company’s official press release. "The consumer fund of up to $425 million that we are announcing today reinforces our commitment to putting consumers first and safeguarding their data - and reflects the seriousness with which we take this matter.”
“We have been committed to resolving this issue for consumers and have the financial capacity to manage the settlement while continuing our $1.25 billion EFX2020 technology and security investment program,” Begor said. “We are focused on the future of Equifax and returning to market leadership and growth."
Back in January 2019, a judge had denied a request from Equifax to dismiss the class-action lawsuit. The New York Times notes that the settlement assumes that just 7 million will sign up for free creditor monitoring. According to the settlement itself, if all 147 million people whose data was breached sign up for monitoring, then Equifax would have to pay a whopping $2 billion.
Consumers have six months to claim their benefits.
Adriana is an associate editor for Yahoo Finance. Follow her on Twitter @adrianambells.