Virginia will receive more than $4 million as part of its share of a multi-state settlement with Equifax over a 2017 data breach.
Consumers in 48 states, the District of Columbia and Puerto Rico will receive $600 million from the credit reporting agency in the largest data breach enforcement action in history. The 2017 breach affected 147 million Americans, including 4 million Virginians.
An investigation by a coalition of 50 attorneys general, including Virginia Attorney General Mark Herring, found that Equifax failed to adequately protect consumer data. Herring said in a press release, despite knowing about a critical vulnerability in its software, Equifax failed to fully patch its system or replace software that monitored its network for suspicious activity.
“More than 4 million Virginians had their personal information compromised by Equifax’s negligence and failure to implement adequate security programs,” Herring said. “I hope this settlement sends a message to companies nationwide that my colleagues and I will not tolerate their failure to keep consumers information protected and private.”
The settlement includes up to $425 million to compensate affected consumers nationwide. Consumers can checkto see if they are eligible to file a claim for free credit monitoring, to recover money they spent for data protection as a result of the breach and/or $125 cash. However, the Federal Trade Commission is recommending that people accept the credit monitoring services in lieu of the cash because they may not get the full amount because so many are filing claims.
In a press release, Equifax CEO Mark W. Begor said the consumer fund “reinforces our commitment to putting consumers first and safeguarding their data - and reflects the seriousness with which we take this matter.”
Lawmakers are considering how to hold credit reporting agencies responsible for future data breaches. US Senator Mark Warner, D-Va, said in a statement that, “While I’m happy to see that customers who have been harmed as a result of Equifax’s shoddy cyber-security practices will see some compensation, we need structural reforms and increased oversight of credit reporting agencies in order to make sure that this never happens again.”
Warner is co-sponsoring legislation that would hold credit reporting agencies responsible for data breaches by compensating consumers for stolen data. He said in a statement the bill would impose mandatory penalties for data breaches and give the Federal Trade Commission more direct authority over data security at credit reporting agencies.
WCVE Intern Reed Canaan produced this story.