WASHINGTON, DC - Equifax, one of the leading consumer reporting agencies, will pay up to $700 million to settle with the 48 states, the District of Columbia and Puerto Rico for one of the largest security breaches ever. The 2017 breach exposed Social Security numbers, names, birthdays, addresses and credit card numbers and in some cases, driver's license numbers.

The settlement is also with the U.S. Consumer Financial Protection Bureau and the Federal Trade Commission and will provide $425 million to a Consumer Restitution Fund and $175 million payment to states and other relief. 

“Companies that profit from personal information have an extra responsibility to protect and secure that data,” said FTC Chairman Joe Simons. “Equifax failed to take basic steps that may have prevented the breach that affected approximately 147 million consumers. This settlement requires that the company take steps to improve its data security going forward, and will ensure that consumers harmed by this breach can receive help protecting themselves from identity theft and fraud.”

“The consumer fund of up to $425 million that we are announcing today reinforces our commitment to putting consumers first and safeguarding their data - and reflects the seriousness with which we take this matter,” said Equifax CEO Mark Begor.

Kentucky Attorney General, Andy Beshear said,  "Our top priority was to make sure the nearly 1.9 million Kentuckians who had their personal data exposed in this breach have access to the Consumer Restitution Fund and extended credit monitoring services,” Beshear said. “We have also made sure that Equifax takes proper responsibility for their actions by implementing stronger data security procedures.” 

Equifax, located in Atlanta, Georgia, did not detect the attack for more than six weeks. 

Consumers might be eligible to receive money by filing one or more claims for conditions including money spent buying credit monitoring or identity theft protection following the breach and the cost of freezing or unfreezing credit reports at other consumer agencies. 

To claim any money, you must submit a claim online or by mail. Paper forms can be requested over the phone.  Consumers will be eligible to obtain information about the settlement, check their eligibility to file a claim and file a claim on the Equifax Settlement Breach online registry.  You can receive updates regarding the launch of the registry by signing up with the FTC HERE. You can also call the settlement administrator at 1-833-759-2982 for more information.

The settlement must still be approved by the federal district court in the Northern District of Georgia.