In a settlement with the FTC, consumers affected by the breach are eligible for up to $20,000 in a cash settlement, depending on damages they can prove.

In 2017, Equifax suffered one of the most infamous data breaches in US history. Personal information of roughly 148 million people was compromised, and the company since has paid for the breach in terms of reputation damage and careers harmed, and now another bill is coming due — this one from the US Federal Trade Commission.

The FTC has announced a settlement with Equifax that will result in the company paying at least $575 million and as much as $700 million to the agency, the Consumer Financial Protection Bureau (CFPB), and 50 US states and territories.

Variation in the total amount comes from uncertainty over just how many consumers will take advantage of the settlement's cash terms. Individuals are eligible for up to $20,000 in a cash settlement depending on the damages they can prove.

In addition, Equifax has agreed to provide at least four years' monitoring of credit reports at the three major credit bureaus, and up to ten years' credit monitoring at Equifax, for every US consumer. Those who were minors in May 2017 are eligible for 18 years of credit monitoring.

Both the fine and its sheer size are significant, according to Alex Calic, strategic technology partnerships officer for The Media Trust. "Companies need to be aware that they can't wait for the breach to occur anymore and just say 'sorry.' They know there's going to be a financial penalty," he says.

That financial penalty has surprised some because of its size — though whether they're surprised because it's so large or so small depends on their point of view. Not everyone was caught off guard, though: "The size didn't surprise me. I wouldn't have been surprised to see several times large, or half this size," admits Rob Clyde, board director and past chair of ISACA. "Below that amount would have raised eyebrows, but you also don't want to destroy the company. There's a balance to be hit."

The FTC appears to want to prevent other companies finding themselves in situations similar to Equifax's breach. "The Equifax fine was to punish people for not paying attention," says Kiersten Todt, managing director of the Cyber Readiness Institute. "If I'm reading the tea leaves, the FTC wants companies to invest in resiliency, not just in response."

She points out the difference in this case and the 2013 Target breach. The difference, she says, is that "after, Target executives were more willing to pay for response than prevention. But now the scale is shifting."

It remains unclear if the Equifax fine by the FTC is a sign of things to come. "We'll see more and more regulators 'bring the hammer down' and levy some of the largest fines ever seen to raise the sense of urgency. This time it’s the FTC, next could be European GDPR, then the upcoming California Consumer Privacy Act," says Pravin Kothari, CEO of CipherCloud.

The fine isn't likely to have a devastating operational impact on Equifax, experts say."The best outcome isn't Equifax making the situation right - although that is important for all of those affected - it's everyone else learning that the price to be paid outweighs the inconvenience of ensuring proper measures are taken to secure the data that puts them at risk in the first place," says Adam Laub, CMO of STEALTHbits Technologies. "It's got to be from the ground up, too. There's no silver bullet."

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register. 

About the Author(s)

Curtis Franklin, Principal Analyst, Omdia

Curtis Franklin Jr. is Principal Analyst at Omdia, focusing on enterprise security management. Previously, he was senior editor of Dark Reading, editor of Light Reading's Security Now, and executive editor, technology, at InformationWeek, where he was also executive producer of InformationWeek's online radio and podcast episodes

Curtis has been writing about technologies and products in computing and networking since the early 1980s. He has been on staff and contributed to technology-industry publications including BYTE, ComputerWorld, CEO, Enterprise Efficiency, ChannelWeb, Network Computing, InfoWorld, PCWorld, Dark Reading, and ITWorld.com on subjects ranging from mobile enterprise computing to enterprise security and wireless networking.

Curtis is the author of thousands of articles, the co-author of five books, and has been a frequent speaker at computer and networking industry conferences across North America and Europe. His most recent books, Cloud Computing: Technologies and Strategies of the Ubiquitous Data Center, and Securing the Cloud: Security Strategies for the Ubiquitous Data Center, with co-author Brian Chee, are published by Taylor and Francis.

When he's not writing, Curtis is a painter, photographer, cook, and multi-instrumentalist musician. He is active in running, amateur radio (KG4GWA), the MakerFX maker space in Orlando, FL, and is a certified Florida Master Naturalist.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights