“It’s a step, but it’s just inadequate,” said Ed Mierzwinski, a senior director at U.S. PIRG, a consumer advocacy group. “It seems to be what they think they should pay, not what they deserve to pay.” Equifax, based in Atlanta, is one of the three biggest credit reporting bureaus, alongside Experian and TransUnion. It holds records on hundreds of millions of people worldwide and delivers about two billion consumer files each year to lenders and other companies seeking information on those taking out mortgages, auto loans, credit cards and other financial products. The company was widely criticized in the days after it revealed its data breach for its slow and haphazard response, which included accidentally pointing people toward a fake version of its own information website on the breach and struggling to keep up with the volume of messages and phone calls from outraged consumers. In a series of fiery hearings on Capitol Hill, lawmakers blasted the company, including Richard Smith, who was its chief executive at the time of the breach, for its missteps. Equifax’s current chief executive, Mark Begor, a former private equity executive who joined the company last year, said in a recent interview with The New York Times that he was working to make the company more secure and more consumer-friendly. “I want to treat customers the way I wanted to be treated,” he said. “We know we have to win back their trust.” Law enforcement and cybersecurity experts have not detected direct fraud against consumers as a result of Equifax’s lapse, but the risk will linger. “It really doesn’t matter that no one has owned up to this,” Mr. Mierzwinski said. “The information is out there. Your financial DNA is like gold. It can sit in a thieves’ vault for years and still be valuable.”
Credit bureau Equifax is expected to pay 690 settling claims linked to a 2017 breach that exposed the data of more than 145 million people. The company said it has upgraded its technology and launched credit monitoring services for those affected in what has been described as one of the worst data leaks in the US. Data had been taken from Equifax over several months through an unpatched vulnerability. Equifax has since complied with new data security rules and said it had set $about $650mm aside to cover legal costs. Critics have called the settlement inadequate.