AG Healey’s Settlement with Equifax

On April 13, 2020, Attorney General Healey announced that her Office reached an $18 million settlement with Equifax

AG Healey settled her lawsuit with Equifax for a record $18 million penalty. 

The consent judgment, entered in Suffolk Superior Court, resolves the AG’s 2017 lawsuit alleging that Equifax failed to patch a known vulnerability in its network, allowing hackers to infiltrate its systems and access the sensitive personal information of least 147 million consumers nationwide.

Under the terms of the proposed settlement, Equifax will pay a $18.225 million penalty to Massachusetts, a portion of which the AG’s Office will use to support local consumer aid programs. The settlement also requires Equifax to take significant steps to strengthen its security practices and bring them into compliance with Massachusetts law, including regularly monitoring its network, identifying critical security updates, minimizing its collection of sensitive data, improving account management tools, and obtaining independent assessments of its data safeguards.

Massachusetts consumers affected by the breach can seek relief under a global settlement reached in July 2019 between Equifax and the Federal Trade Commission, the Consumer Financial Protection Bureau, 50 States and territories, and in a national class action lawsuit. These settlements created a Consumer Restitution Fund of up to $425 million to help people affected by the Data Breach – including Massachusetts residents. They also offer a variety of programs to assist consumers with protecting their personal information, freezing and monitoring their credit files, and assistance in the event they suffer ID theft. Information about the settlements and how to make a claim for benefits can be found on the FTC’s website and the Equifax Breach Settlement website.

Below are frequently asked questions about AG Healey’s settlement with Equifax. 

How is this different than the settlements announced this past summer?

This past summer, Equifax settled with the Federal Trade Commission, the Consumer Financial Protection Bureau, and 50 States and territories. Equifax also announced a settlement of a nationwide class action suit brought against it by consumers. These settlements created a Consumer Restitution Fund of up to $425 million to help people affected by the Data Breach – including Massachusetts residents. They also offer a variety of programs to assist consumers with protecting their personal information, freezing and monitoring their credit files, assistance in the event they suffer identity theft, and the chance to seek payments for resulting identity theft. Information about the settlements can be found on the FTC’s website and the Equifax Breach Settlement website.

AG Healey's lawsuit is a separate law enforcement action against Equifax for its violations of Massachusetts consumer protection and data protection laws. This settlement imposes a civil penalty on Equifax of $18.2 million, requires Equifax to change its data security practices to better safeguard consumers’ personal information, and requires Equifax to make available various services and assistance to affected Massachusetts residents affected by the Data Breach. Importantly, this settlement does not affect the ability of Massachusetts residents to take full advantage of the Consumer Restitution Fund, or any of the various benefits and services offered under the national settlements.

Why did the AG's Office settle?

After Equifax announced the data breach in early September 2017, AG Healey immediately launched an investigation to determine the scope of risk to consumers and whether the company had proper safeguards in place to protect consumer information. Within days, the AG’s Office sued Equifax under the state consumer protection and data privacy laws, and committed to ensuring that Equifax comply with Massachusetts law, better protect consumers’ data, and pay a significant penalty for its mistakes.

This settlement achieves the goals our lawsuit: it penalizes Equifax for its violation of law, forces it to improve its data security practices to better protect consumers’ data, and ensures that Massachusetts consumers have access to all benefits under the global settlement. With this settlement, we can focus our resources on protecting consumers’ sensitive data going forward.

Will Massachusetts consumers get money from this settlement?

This settlement does not include payments or refunds for consumers. It does, however, ensure that Massachusetts residents can seek payment for any identity theft they may suffer from the breach from a Consumer Restitution Fund of up to $425 million, which was established as part of a global settlement between Equifax and the Federal Trade Commission, the Consumer Financial Protection Bureau, 50 States and U.S. Territories, and in a national class action law suit. Information about this consumer relief can be obtained by visiting the Federal Trade Commission’s website and a website set up by the Equifax Settlement Administrator. We have reviewed these settlements and believe the Consumer Settlement Fund has enough money to pay all Massachusetts consumers for out-of-pocket losses. 

To find out if you were affected by the Equifax breach, you can call 1-833-759-2982 or visit here.

What are benefits are available to consumers under the Global Settlements?

The consumer benefits under the national settlements between Equifax and the FTC, CFPB, 50 States and U.S. Territories, and in a national class action lawsuit will not be distributed until they are given final court approval.  

To take advantage of these benefits, you will need to file a claim. You can currently file a claim for expenses you incur between January 23, 2020 and January 22, 2024, as a result of identity theft or fraud related to the breach, such as:

  • Losses from unauthorized charges to your accounts.
  • Fees you paid to professionals, like accountants or attorneys, to help you recover from identity theft.
  • Other expenses you incurred while recovering from identity theft, like notary fees, document shipping fees, postage, mileage, and phone charges.

You also can file a claim for the time you spent recovering from identity theft or fraud between January 23, 2020, and January 22, 2024. You can be compensated up to $25 per hour up to 20 hours. There are limited funds available so your claim may be reduced.

Even if you don’t file a claim for reimbursement, you may be eligible under the national class action settlement for free identity restoration services if you discover misuse of your personal information. The Federal Trade Commission will update its website when this benefit becomes available.

Also, Equifax is providing all U.S. consumers 6 free Equifax credit reports per year through 2026 by visiting the Equifax website or by calling 1-866-349-5191. That’s in addition to the one free Equifax report (plus your Experian and TransUnion reports) you can get at AnnualCreditReport.com.

More information from the FTC about these benefits can be found here.

What if I think I’m a victim of identity theft?

The Federal Trade Commission’s website, IdentityTheft.gov, will walk you through reporting and recovering from identity theft.

If you believe you have suffered losses as a result of identity theft related to the Equifax Data Breach, and want to seek recovery from the Consumer Restitution Fund, you will need to file a claim to the national Consumer Restitution Fund.  Your claims can include losses you may have suffered as a result of identity theft or fraud related to the breach, and for time you spent recovering from identity theft or fraud, between January 23, 2020 and January 22, 2024. Be aware that there are limited funds available in the Consumer Settlement Fund, so your claim may be reduced.  In addition, funds will not be distributed until the national settlement receives final court approval.   

More information about the Consumer Restitution Fund is available at the Federal Trade Commission’s website and a website set up by the Equifax settlement administrator.

In addition, even if you don’t file a claim for reimbursement, you may be eligible under the national class action settlement for free identity restoration services if you discover misuse of your personal information. The Federal Trade Commission will update its website when this benefit becomes available.

Do you know of any direct harm to consumers in Massachusetts from this breach?

We are not aware of any cases of identity theft that directly resulted from this breach. But, because the Data Breach compromised sensitive personal information, including names and social security numbers, all affected consumers are at a higher risk of identity theft. Freezing your credit file, reviewing your credit reports, and carefully monitoring your existing accounts for unauthorized use are important steps to prevent or quickly detect identity theft. Learn how to place a credit freeze.

If you believe you have suffered losses as a result of identity theft related to this Data Breach, you can file a claim to seek recovery from the Consumer Settlement Fund. Claims include losses you may have suffered as a result of identity theft or fraud related to the breach, and for time you spent recovering from identity theft or fraud, between January 23, 2020 and January 22, 2024. Be aware that there are limited funds available in the Consumer Restitution Fund, so your claim may be reduced. 

What if I missed the deadline to sign up for the free credit monitoring services offered by Equifax?

The initial deadline to file a claim in the national class action settlement, including to request the free credit monitoring, was January 22, 2020. However, you may still have free credit monitoring provided through another source. If you do, be sure to carefully read the terms of the credit monitoring service, especially if there are any free trial offers that may eventually convert to regular payments for the service.

While credit monitoring can be a helpful service, it does not prevent identity theft; it can only alert you if it is happening.  You should also consider placing a credit freeze with each of the major credit reporting agencies or taking additional steps to guard against identity theft. 

Learn how to place a credit freeze.

Also, after January 22, 2020, you can still file a claim for expenses you incur between January 23, 2020 and January 22, 2024, as a result of identity theft or fraud related to the breach, such as:

  • Losses from unauthorized charges to your accounts.
  • Fees you paid to professionals, like accountants or attorneys, to help you recover from identity theft.
  • Other expenses you incurred while recovering from identity theft, like notary fees, document shipping fees, postage, mileage, and phone charges.

You also can file a claim for the time you spent recovering from identity theft or fraud between January 23, 2020, and January 22, 2024. You can be compensated up to $25 per hour up to 20 hours. There are limited funds available so your claim may be reduced.

In addition, even if you don’t file a claim for reimbursement, you may be eligible under the national class action settlement for free identity restoration services if you discover misuse of your personal information. The Federal Trade Commission will update its website when this benefit becomes available.

Help Us Improve Mass.gov  with your feedback

Please do not include personal or contact information.
Feedback