[Ari Shapiro:] Two years ago, hackers hit the credit bureau Equifax and exposed the data of nearly 150 million people. That's more than half the adult population of the United States. Now some of the people affected by that breach stand to be compensated. Equifax will pay up to $700 million in fines and monetary relief to consumers. We're joined by NPR's Chris Arnold, who has been following today's settlement with state and federal regulators. Hi, Chris.
[Chris Arnold, Byline:] Hey, Ari.
[Ari Shapiro:] So is most of this money actually going to go to people who were affected in some way by the breach?
[Chris Arnold, Byline:] Well, most of it will. It looks like upwards of $400 million will go to those people. We spoke to California's attorney general, Xavier Becerra, who was involved in the settlement along with other state and federal regulators. And here's what he said.
[Xavier Becerra:] We're trying to make sure that anyone who was impacted by this data security breach has a chance to recover their costs. If you lost your privacy, if identity thieves have taken advantage of your private information, you deserve to be compensated by Equifax.
[Chris Arnold, Byline:] Now, people can conceivably get up to as much as $20,000. They got to document the time and what all this cost them. For many people, it'll probably be a lot less. Also, if you spent money and time just signing up for preventive stuff, like credit monitoring or whatever else you had to do, the goal is that you will be compensated for that too. And they'll pay I think it's $25 an hour for up to 20 hours that you had to deal with that.
[Ari Shapiro:] I'm sure many people are asking, how do I get the money? What do they have to do?
[Chris Arnold, Byline:] I'm sure, since there were that many people involved in the breach, yes. There is a website, as there often is equifaxbreachsettlement.com. I'm going to say that again because it's radio equifaxbreachsettlement.com. Assuming the court approves the settlement, people can go there. And they'll tell you what to do. But you have to do this within the next six months to get compensation.
[Ari Shapiro:] Within six months of court approval of the settlement.
[Chris Arnold, Byline:] Right.
[Ari Shapiro:] It's always hard to get a sense of the magnitude of these penalties with huge, huge companies. Is $700 million viewed as a meaningful deterrent for a company as big as Equifax?
[Chris Arnold, Byline:] Well, it depends on who you talk to. But with consumer advocates not so much. We talked to Ed Mierzwinski with the nonprofit consumer advocacy group U.S. PIRG. He says, look. I mean, it's great that people are getting some money back. That's fantastic. But as far as a real effective deterrent...
[Ed Mierzwinski:] I don't think it's a lot of money. I think it's more of, hey, go away money rather than a real penalty or a punishment. And I think that's a calculated bet by Equifax. They went in there and negotiated a parking ticket rather than a punishment.
[Chris Arnold, Byline:] And at least some of the people affected by the breach feel the same way. We spoke with Jessamyn West from Randolph, Vt. Her information was stolen, she says. And here's her reaction that people will be getting some money back.
[Jessamyn West:] I mean, it's garbage, right? Like, money isn't going to solve this problem. Like, what we need is an overhaul of the way bank corporations are allowed to handle our personal information.
[Ari Shapiro:] It's interesting, Chris, that, like, Equifax wasn't the hackers here, right? Equifax got hacked, and yet everybody wants to punish Equifax. There were hearings in Congress when news broke. Lawmakers were outraged. Explain why there was so much anger at the company that, in all likelihood, sees itself as the victim.
[Chris Arnold, Byline:] Sure. You know, first, 150 million people but what Equifax has in its sort of vaults of information is your credit score, which allows you to get a mortgage or a loan. They got your credit card numbers, your Social Security number. You know, and this exposed that they were not doing a good job keeping that safe.
[Ari Shapiro:] And has any policy changed to prevent this from happening in the future?
[Chris Arnold, Byline:] Well, very quickly, there has not been a major overhaul for regulating credit bureaus that may be coming, though. There is some bipartisan support. We should also say Equifax, in a statement, called today's settlement, quote, "a positive step for U.S. consumers."
[Ari Shapiro:] NPR's Chris Arnold, thanks a lot.
[Chris Arnold, Byline:] Thanks, Ari.