Loading
Finance
9 min read
Areas of Expertise :
Cybersecurity, Data Breach, Data Privacy, Computer Forensics, Risk Management
Published Date:
Last Modified Date:
Jurisdiction:
Federal. Eleventh Circuit
On September 7, 2017, Equifax announced a large-scale intrusion that exposed sensitive personal information and led to hundreds of consumer class actions. The Judicial Panel on Multidistrict Litigation consolidated the federal cases in the Northern District of Georgia as MDL No. 2800 and assigned them to Judge Thomas W. Thrash Jr. Judge Thrash issued the original final approval order for the consumer class settlement on January 13, 2020, followed by an amended order on March 17, 2020, that became the operative decision reviewed on appeal. The district court called the result “the largest and most comprehensive recovery in a data breach case in U.S. history,” a description later referenced by the Eleventh Circuit. On June 3, 2021, the appellate court affirmed the settlement approval and class certification but vacated the incentive awards granted to the class representatives. The Supreme Court denied certiorari in Huang on November 1, 2021, and in Watkins on January 10, 2022, leaving the settlement intact without those awards.
The settlement covered approximately 147 million affected consumers and created an initial $380.5 million fund, with up to an additional $125 million available for eligible out-of-pocket losses. It also offered credit-monitoring, identity-protection, and identity-restoration services, with settlement materials estimating that the credit-monitoring benefits could approach $2 billion in value if every eligible class member enrolled. Equifax was also required to spend at least $1 billion over five years on data-security measures subject to independent assessment and court enforcement, linking consumer relief to continuing computer security obligations. The class settlement formed part of a broader resolution involving the Federal Trade Commission, Consumer Financial Protection Bureau, and state and territorial authorities. That coordinated package required at least $575 million and potentially as much as $700 million, including a consumer fund of up to $425 million, $175 million for states and territories, and a $100 million civil penalty payable to the CFPB. The resulting decisions addressed Article III standing, class certification, settlement approval, incentive awards, consumer remedies, and continuing data-security obligations.
Equifax announced that unauthorized actors had accessed highly sensitive personal and financial information, prompting consumer lawsuits across the United States. The number of affected consumers and the nature of the compromised data created common factual and legal issues that later supported coordinated federal proceedings.
The Judicial Panel on Multidistrict Litigation consolidated dozens of filed actions, along with hundreds of potential tag-along cases, before Judge Thomas W. Thrash Jr. The panel cited the need to prevent duplicative discovery and inconsistent rulings, as well as Equifax’s headquarters and the concentration of pending cases in the district. The centralized litigation concerned a nationwide computer security incident that compromised the personal information of more than 145 million consumers.
The Federal Trade Commission, Consumer Financial Protection Bureau, states, territories, and consumer plaintiffs announced a coordinated resolution requiring Equifax to pay at least $575 million and potentially as much as $700 million. The package included an initial $300 million consumer fund that could increase to $425 million, $175 million for states and territories, and a $100 million civil penalty payable to the CFPB. Equifax also agreed to strengthen its data-security safeguards. Although the government enforcement proceedings and private class action involved different claims and parties, the settlement terms were coordinated, and the consumer fund was included within the potential $700 million maximum rather than added to it.
Judge Thrash granted final approval to the consumer class settlement on January 13, 2020, and entered an amended final approval order on March 17, 2020. The settlement covered approximately 147 million affected consumers and established an initial $380.5 million fund, with up to an additional $125 million available for eligible out-of-pocket losses. Benefits included reimbursements of up to $20,000 per claimant, compensation for time spent addressing breach-related issues, multi-year credit monitoring, identity-restoration services, and injunctive relief requiring Equifax to spend at least $1 billion over five years on data security. Those expenditures were subject to independent assessment and court enforcement. The March 17 amended order became the operative approval order reviewed on appeal.
The Eleventh Circuit rejected the objectors’ challenges to the settlement approval and class certification. The court referred to the district court’s description of the recovery as “the largest and most comprehensive” in a U.S. data-breach case. It vacated only the incentive awards granted to the class representatives, applying circuit precedent that prohibited those payments. The opinion also addressed Article III standing, the benefits available to class members, and Equifax’s continuing data-security obligations.
The Supreme Court denied the petition for certiorari in Huang on November 1, 2021, and denied the petition in Watkins on January 10, 2022. Those denials left the settlement approval and class certification in place without the vacated incentive awards. Settlement implementation continued through monetary relief, credit-monitoring and identity-restoration services, and data-security obligations subject to independent assessment and court enforcement.
The district court ruled on several complaints filed by consumers who had opted out of the class settlement, granting the pending motions in part and denying them in part. It also suggested remand for further proceedings in specified actions. The order addressed the remaining litigation posture after final approval and the Eleventh Circuit’s decision, while settlement administration continued through monetary reimbursements, time compensation, credit-monitoring services, and identity-restoration benefits.
Court:
United States District Court for the Northern District of Georgia
Case Name:
In re Equifax Inc. Customer Data Security Breach Litigation
Computer Security
Information Security
Identity Theft
Consumer Data Industry
Consumer Protection
Fair Credit Reporting
Online Privacy
Internet Security
On September 7, 2017, Equifax announced a large-scale intrusion that exposed sensitive personal information and led to hundreds of consumer class actions. The Judicial Panel on Multidistrict Litigation consolidated the federal cases in the Northern District of Georgia as MDL No. 2800 and assigned them to Judge Thomas W. Thrash Jr. Judge Thrash issued the original final approval order for the consumer class settlement on January 13, 2020, followed by an amended order on March 17, 2020, that became the operative decision reviewed on appeal. The district court called the result “the largest and most comprehensive recovery in a data breach case in U.S. history,” a description later referenced by the Eleventh Circuit. On June 3, 2021, the appellate court affirmed the settlement approval and class certification but vacated the incentive awards granted to the class representatives. The Supreme Court denied certiorari in Huang on November 1, 2021, and in Watkins on January 10, 2022, leaving the settlement intact without those awards.
The settlement covered approximately 147 million affected consumers and created an initial $380.5 million fund, with up to an additional $125 million available for eligible out-of-pocket losses. It also offered credit-monitoring, identity-protection, and identity-restoration services, with settlement materials estimating that the credit-monitoring benefits could approach $2 billion in value if every eligible class member enrolled. Equifax was also required to spend at least $1 billion over five years on data-security measures subject to independent assessment and court enforcement, linking consumer relief to continuing computer security obligations. The class settlement formed part of a broader resolution involving the Federal Trade Commission, Consumer Financial Protection Bureau, and state and territorial authorities. That coordinated package required at least $575 million and potentially as much as $700 million, including a consumer fund of up to $425 million, $175 million for states and territories, and a $100 million civil penalty payable to the CFPB. The resulting decisions addressed Article III standing, class certification, settlement approval, incentive awards, consumer remedies, and continuing data-security obligations.
Equifax announced that unauthorized actors had accessed highly sensitive personal and financial information, prompting consumer lawsuits across the United States. The number of affected consumers and the nature of the compromised data created common factual and legal issues that later supported coordinated federal proceedings.
The Judicial Panel on Multidistrict Litigation consolidated dozens of filed actions, along with hundreds of potential tag-along cases, before Judge Thomas W. Thrash Jr. The panel cited the need to prevent duplicative discovery and inconsistent rulings, as well as Equifax’s headquarters and the concentration of pending cases in the district. The centralized litigation concerned a nationwide computer security incident that compromised the personal information of more than 145 million consumers.
The Federal Trade Commission, Consumer Financial Protection Bureau, states, territories, and consumer plaintiffs announced a coordinated resolution requiring Equifax to pay at least $575 million and potentially as much as $700 million. The package included an initial $300 million consumer fund that could increase to $425 million, $175 million for states and territories, and a $100 million civil penalty payable to the CFPB. Equifax also agreed to strengthen its data-security safeguards. Although the government enforcement proceedings and private class action involved different claims and parties, the settlement terms were coordinated, and the consumer fund was included within the potential $700 million maximum rather than added to it.
Judge Thrash granted final approval to the consumer class settlement on January 13, 2020, and entered an amended final approval order on March 17, 2020. The settlement covered approximately 147 million affected consumers and established an initial $380.5 million fund, with up to an additional $125 million available for eligible out-of-pocket losses. Benefits included reimbursements of up to $20,000 per claimant, compensation for time spent addressing breach-related issues, multi-year credit monitoring, identity-restoration services, and injunctive relief requiring Equifax to spend at least $1 billion over five years on data security. Those expenditures were subject to independent assessment and court enforcement. The March 17 amended order became the operative approval order reviewed on appeal.
The Eleventh Circuit rejected the objectors’ challenges to the settlement approval and class certification. The court referred to the district court’s description of the recovery as “the largest and most comprehensive” in a U.S. data-breach case. It vacated only the incentive awards granted to the class representatives, applying circuit precedent that prohibited those payments. The opinion also addressed Article III standing, the benefits available to class members, and Equifax’s continuing data-security obligations.
The Supreme Court denied the petition for certiorari in Huang on November 1, 2021, and denied the petition in Watkins on January 10, 2022. Those denials left the settlement approval and class certification in place without the vacated incentive awards. Settlement implementation continued through monetary relief, credit-monitoring and identity-restoration services, and data-security obligations subject to independent assessment and court enforcement.
The district court ruled on several complaints filed by consumers who had opted out of the class settlement, granting the pending motions in part and denying them in part. It also suggested remand for further proceedings in specified actions. The order addressed the remaining litigation posture after final approval and the Eleventh Circuit’s decision, while settlement administration continued through monetary reimbursements, time compensation, credit-monitoring services, and identity-restoration benefits.
Computer Security Expert Witness
Computer security experts could assess patch management, network defenses, encryption, access controls, incident response, and the safeguards in place before and after the intrusion. They could also evaluate whether Equifax’s remedial measures complied with the settlement’s five-year data-security obligations, including the requirement for at least $1 billion in spending subject to independent assessment and court enforcement.
Data Privacy and Regulatory Compliance Expert Witnesses
Data privacy and regulatory compliance experts could assess the consumer-protection and privacy requirements raised in the litigation, including FCRA-related claims, notice obligations, and the interaction between the private settlement and federal, state, and territorial oversight. They could also evaluate whether Equifax’s policies and continuing governance measures aligned with the obligations imposed through the coordinated resolution.
Economic Damages Expert Witness
Economic damages experts could evaluate claimed out-of-pocket losses, time spent responding to the breach, identity-theft mitigation costs, and the valuation of settlement benefits available to affected consumers. They could also assess the methodology used to estimate aggregate consumer losses and the potential value of credit-monitoring, identity-protection, and identity-restoration services.
Risk Management Expert Witness
Risk management experts could assess whether Equifax’s corporate controls, internal reporting procedures, and data-security governance adequately addressed known and foreseeable risks. They could also evaluate the coordination of regulatory compliance, incident response, business continuity planning, and information-security oversight before and after the breach.
Centralization Through Multidistrict Litigation
The Judicial Panel on Multidistrict Litigation consolidated more than 300 consumer class actions into MDL No. 2800 to coordinate case management and promote consistent rulings. Centralization reduced duplicative discovery and the risk of conflicting decisions across federal courts. It also allowed claims arising from the same nationwide data breach to proceed before one district court under a common procedural framework.
Structuring Comprehensive Settlement Relief
The settlement combined monetary payments, credit monitoring, compensation for time spent addressing breach-related issues, and injunctive relief requiring Equifax to invest at least $1 billion in data security. This structure addressed immediate consumer losses while imposing continuing obligations directed at security controls and compliance. The relief therefore included both direct benefits for affected consumers and court-enforceable measures extending beyond the monetary settlement.
Addressing Standing and Concrete Injury
The Eleventh Circuit found Article III standing and affirmed the settlement approval and class certification, while separately vacating the incentive awards under controlling circuit precedent. The court issued its Equifax opinion before the Supreme Court decided TransUnion LLC v. Ramirez later that month. In the procedural posture before it, the Eleventh Circuit relied on allegations involving the theft of highly sensitive information, the resulting risk of identity theft, and mitigation costs. Its standing analysis was tied to those allegations and the settlement appeal presented to the court.
Coordinating Private and Government Settlement Terms
The consumer class settlement was coordinated with resolutions involving the FTC, CFPB, and state and territorial authorities. The overall package required Equifax to pay at least $575 million and potentially up to $700 million, including a consumer fund that could reach $425 million, payments to states and territories, and the CFPB civil penalty. The coordinated terms addressed consumer compensation, government enforcement claims, and continuing data-security requirements without treating the consumer fund as an additional recovery beyond the package’s stated maximum.
Implementing Injunctive Oversight in Data-Breach Litigation
The court-approved settlement required Equifax to undergo independent assessments of its data-security measures for five years. These provisions extended the resolution beyond financial relief by creating continuing review and court-enforceable obligations. The settlement used defined assessment and enforcement mechanisms to monitor Equifax’s compliance during that period.
The Equifax data breach litigation concluded with the consumer class settlement and class certification remaining in place after the Eleventh Circuit affirmed the district court’s approval but vacated the incentive awards to the class representatives. The Supreme Court’s denials of certiorari on November 1, 2021, and January 10, 2022, left that result undisturbed. The settlement provided monetary reimbursements, time compensation, credit-monitoring and identity-restoration services for a class of approximately 147 million consumers, while the coordinated resolution required Equifax to maintain five years of independently assessed, court-enforceable data-security measures supported by at least $1 billion in spending.
What information was exposed in the Equifax data breach?
The breach, disclosed on September 7, 2017, exposed personal information belonging to approximately 147 million people. The compromised data included Social Security numbers, birth dates, addresses, and other sensitive identifying information.
How was the Equifax data breach litigation resolved?
The federal consumer actions were centralized in MDL No. 2800 in the Northern District of Georgia. The district court granted final approval on January 13, 2020, and entered an amended approval order on March 17, 2020; the Eleventh Circuit later affirmed the settlement approval and class certification but vacated the incentive awards. The Supreme Court denied review on November 1, 2021, and January 10, 2022, leaving the settlement in place without those awards.
How much was the Equifax settlement worth?
The class settlement created an initial $380.5 million fund, with up to an additional $125 million available for eligible out-of-pocket losses. Settlement materials estimated that the credit-monitoring services could approach $2 billion in value if every eligible class member enrolled, while the coordinated public resolution included a consumer fund of up to $425 million within a potential $700 million package. Equifax was also required to spend at least $1 billion over five years on data-security measures subject to independent assessment and court enforcement.
Did Equifax face government penalties?
Yes. The coordinated resolution with the FTC, CFPB, and state and territorial authorities required Equifax to pay at least $575 million and potentially up to $700 million. The package included an initial $300 million consumer fund that could increase to $425 million, $175 million for states and territories, and a $100 million civil penalty payable to the CFPB.
What benefits were available to affected consumers?
Computer Security Expert Witness
Computer security experts could assess patch management, network defenses, encryption, access controls, incident response, and the safeguards in place before and after the intrusion. They could also evaluate whether Equifax’s remedial measures complied with the settlement’s five-year data-security obligations, including the requirement for at least $1 billion in spending subject to independent assessment and court enforcement.
Data Privacy and Regulatory Compliance Expert Witnesses
Data privacy and regulatory compliance experts could assess the consumer-protection and privacy requirements raised in the litigation, including FCRA-related claims, notice obligations, and the interaction between the private settlement and federal, state, and territorial oversight. They could also evaluate whether Equifax’s policies and continuing governance measures aligned with the obligations imposed through the coordinated resolution.
Economic Damages Expert Witness
Economic damages experts could evaluate claimed out-of-pocket losses, time spent responding to the breach, identity-theft mitigation costs, and the valuation of settlement benefits available to affected consumers. They could also assess the methodology used to estimate aggregate consumer losses and the potential value of credit-monitoring, identity-protection, and identity-restoration services.
Risk Management Expert Witness
Risk management experts could assess whether Equifax’s corporate controls, internal reporting procedures, and data-security governance adequately addressed known and foreseeable risks. They could also evaluate the coordination of regulatory compliance, incident response, business continuity planning, and information-security oversight before and after the breach.
Centralization Through Multidistrict Litigation
The Judicial Panel on Multidistrict Litigation consolidated more than 300 consumer class actions into MDL No. 2800 to coordinate case management and promote consistent rulings. Centralization reduced duplicative discovery and the risk of conflicting decisions across federal courts. It also allowed claims arising from the same nationwide data breach to proceed before one district court under a common procedural framework.
Structuring Comprehensive Settlement Relief
The settlement combined monetary payments, credit monitoring, compensation for time spent addressing breach-related issues, and injunctive relief requiring Equifax to invest at least $1 billion in data security. This structure addressed immediate consumer losses while imposing continuing obligations directed at security controls and compliance. The relief therefore included both direct benefits for affected consumers and court-enforceable measures extending beyond the monetary settlement.
Addressing Standing and Concrete Injury
The Eleventh Circuit found Article III standing and affirmed the settlement approval and class certification, while separately vacating the incentive awards under controlling circuit precedent. The court issued its Equifax opinion before the Supreme Court decided TransUnion LLC v. Ramirez later that month. In the procedural posture before it, the Eleventh Circuit relied on allegations involving the theft of highly sensitive information, the resulting risk of identity theft, and mitigation costs. Its standing analysis was tied to those allegations and the settlement appeal presented to the court.
Coordinating Private and Government Settlement Terms
The consumer class settlement was coordinated with resolutions involving the FTC, CFPB, and state and territorial authorities. The overall package required Equifax to pay at least $575 million and potentially up to $700 million, including a consumer fund that could reach $425 million, payments to states and territories, and the CFPB civil penalty. The coordinated terms addressed consumer compensation, government enforcement claims, and continuing data-security requirements without treating the consumer fund as an additional recovery beyond the package’s stated maximum.
Implementing Injunctive Oversight in Data-Breach Litigation
The court-approved settlement required Equifax to undergo independent assessments of its data-security measures for five years. These provisions extended the resolution beyond financial relief by creating continuing review and court-enforceable obligations. The settlement used defined assessment and enforcement mechanisms to monitor Equifax’s compliance during that period.
The Equifax data breach litigation concluded with the consumer class settlement and class certification remaining in place after the Eleventh Circuit affirmed the district court’s approval but vacated the incentive awards to the class representatives. The Supreme Court’s denials of certiorari on November 1, 2021, and January 10, 2022, left that result undisturbed. The settlement provided monetary reimbursements, time compensation, credit-monitoring and identity-restoration services for a class of approximately 147 million consumers, while the coordinated resolution required Equifax to maintain five years of independently assessed, court-enforceable data-security measures supported by at least $1 billion in spending.
What information was exposed in the Equifax data breach?
The breach, disclosed on September 7, 2017, exposed personal information belonging to approximately 147 million people. The compromised data included Social Security numbers, birth dates, addresses, and other sensitive identifying information.
How was the Equifax data breach litigation resolved?
The federal consumer actions were centralized in MDL No. 2800 in the Northern District of Georgia. The district court granted final approval on January 13, 2020, and entered an amended approval order on March 17, 2020; the Eleventh Circuit later affirmed the settlement approval and class certification but vacated the incentive awards. The Supreme Court denied review on November 1, 2021, and January 10, 2022, leaving the settlement in place without those awards.
How much was the Equifax settlement worth?
The class settlement created an initial $380.5 million fund, with up to an additional $125 million available for eligible out-of-pocket losses. Settlement materials estimated that the credit-monitoring services could approach $2 billion in value if every eligible class member enrolled, while the coordinated public resolution included a consumer fund of up to $425 million within a potential $700 million package. Equifax was also required to spend at least $1 billion over five years on data-security measures subject to independent assessment and court enforcement.
Did Equifax face government penalties?
Yes. The coordinated resolution with the FTC, CFPB, and state and territorial authorities required Equifax to pay at least $575 million and potentially up to $700 million. The package included an initial $300 million consumer fund that could increase to $425 million, $175 million for states and territories, and a $100 million civil penalty payable to the CFPB.
What benefits were available to affected consumers?
Eligible consumers could seek reimbursement of up to $20,000 for qualifying out-of-pocket losses and compensation for time spent responding to the breach. The settlement also provided credit-monitoring, identity-protection, and identity-restoration services.
How did the settlement address continuing computer security concerns?
The settlement required Equifax to spend at least $1 billion over five years on data-security measures. Those obligations were subject to independent assessment and court enforcement, linking consumer relief with continuing computer security requirements.
Computer Security
Information Security
Identity Theft
Consumer Data Industry
Consumer Protection
Fair Credit Reporting
Online Privacy
Internet Security
Broker, +4
Finance
Forensic Accounting, +4
Finance
Eligible consumers could seek reimbursement of up to $20,000 for qualifying out-of-pocket losses and compensation for time spent responding to the breach. The settlement also provided credit-monitoring, identity-protection, and identity-restoration services.
How did the settlement address continuing computer security concerns?
The settlement required Equifax to spend at least $1 billion over five years on data-security measures. Those obligations were subject to independent assessment and court enforcement, linking consumer relief with continuing computer security requirements.