SPRINGFIELD — Illinois residents could be eligible for up to $20,000 in compensation for damages they suffered as a result of a massive data breach at the credit-reporting bureau Equifax under terms of a proposed global settlement announced Monday.
Attorney General Kwame Raoul announced the settlement in a news release, saying the state of Illinois would also be in line for roughly $7.3 million to cover its cost for the litigation.
“The Equifax data breach compromised the personal information of millions of Illinoisans,” Raoul said in the release. “This historic settlement should send the message that companies – particularly those tasked with protecting personal information – will be held accountable for not doing enough to keep consumers’ sensitive, personal information secured.”
The data breach occurred from mid-May through July 2017, but Equifax did not publicly disclose it until September 2017. During the breach, according to the Federal Trade Commission, cybercriminals were able to access personal data from an estimated 147 million Americans, or more than half of the U.S. adult population. The stolen data included individuals’ names, addresses, dates of birth, Social Security numbers and driver’s license numbers.
Former Attorney General Lisa Madigan estimated at the time that as many as 5.4 million Illinoisans were affected by the breach.
Madigan’s office filed one of the first class action lawsuits against Equifax in state court in Illinois. Similar suits were eventually consolidated into a single federal case in the Northern District of Georgia. It involved the Federal Trade Commission, the Consumer Financial Protection Bureau and 50 U.S. states, territories and the District of Columbia. Raoul’s office took over the case after he was sworn in as attorney general in January.
Under terms of the proposed settlement, which must be approved by a federal judge, Equifax could pay as much as $700 million. That includes $425 million to help people affected by the data breach. The settlement also includes civil penalties and the cost of litigation.
Individual consumers would be eligible for four years of free monitoring of their credit reports with all three major credit bureaus — Equifax, Experian and TransUnion — plus an additional six years of free monitoring of their Equifax credit report. Consumers could instead accept a $125 payment if they already have credit monitoring.
In addition, consumers affected by the breach may receive $1 million worth of identity theft insurance.
And those who were victims of identity theft resulting from the breach would be eligible for cash payments, capped at $20,000 per person, for losses incurred. Those include unauthorized charges to their accounts, the cost of freezing or unfreezing their credit reports, the cost of credit monitoring, fees paid to accountants, attorneys and other professionals, and the time spent dealing with the breach.