The Legal Implications of the Equifax Breach: What Consumers Should Know

On the heels of one of the most serious data security breaches in U.S. consumer history, the credit giant Equifax is dealing with escalating legal and regulatory pressure. Scrutiny is coming from a variety of sources, including federal government agencies, state officials and members of congress.

Given the scope of the breach (detailed personal and financial records of more than 140 million people were potentially exposed), the political and legal response has been forceful. A flurry of lawsuits were filed on behalf of consumers, while the FBI and the Department of Justice are both launching investigations into the possibility of criminal wrongdoing.

The legal and political maneuvering doesn’t end there. The Federal Trade Commission has also launched an investigation into the breach. In addition to action at the federal level, the state of Massachusetts has filed a lawsuit against Equifax — a move that several other states are now considering. Meanwhile, legislators have called for congressional hearings into the breach.

Equifax is also experiencing serious turbulence with regard to its financials. The company’s stock price plunged by roughly one-third following the breach. Additionally, more than 70 class action lawsuits have been filed against Equifax as a result of the security lapse.

What this means for companies and consumers

The Equifax breach has been disastrous for all parties involved. The company is facing the threat of stricter regulations, criminal investigations, serious reputational harm and an extended series of lawsuits. Consumers, meanwhile, must deal with the threat of identity theft and other financial crimes, and the uncertainty that comes with not knowing if and when such events may occur.

Should the worst happen, legal remedies are one avenue for seeking redress. If consumers are able to show that their credit has been compromised as a result of the breach, they may have grounds to sue. A lawsuit may also be worth pursuing to recoup credit monitoring costs accrued as a result of the breach. While Equifax offered free monitoring to those affected, the company drew widespread criticism for appearing to insert an arbitration clause into the user agreement.

There appears to be no consistent standard used in federal courts to establish legal standing in data breach cases. However, the majority of courts have held that the simple act of data theft is sufficient grounds for establishing standing. Plaintiffs, however, generally must show causation of damages, a legal term that means that any harm caused must be traced specifically to the breach in question, rather than another data security incident. This may be difficult.

Class action lawsuits are also ongoing, and will take some time to resolve. As the discovery process plays out, more details about the breach and how it may affect consumers are likely to emerge.

We welcome your legal questions for topically relevant articles in the future. Feel free to compose a question – it may be addressed in future articles. Email Question