Equifax pays $700 million for flawed security personal data

Equifax is reportedly going to pay around $700 million in compensation for the inadequate security of the personal data of millions of Americans. That data was stolen in 2017.

The lion’s share of the money will go to consumers affected by the data breach, according to sources from The Wall Street Journal and The New York Times. Many have filed a class-action lawsuit, which means that the final amount Equifax loses to the case may still differ, as people can still join. This agreement would mark the end of investigations into the company being conducted by the US government and various state governments. An official announcement may be made on Monday.

Also part of this settlement would be that more security measures are taken. Equifax is headed for a total security spending of $1.25 billion since the hack, according to the two US news outlets.

When exploiting the data breach by unknown hackers, social security numbers, dates of birth and addresses were stolen, among other things. The leak turned out to be in Apache Struts, but that vulnerability had already been closed by Apache six months earlier. The credit rating agency apparently had not updated its software to guard against this attack.

Update, Monday: The US Federal Trade Commission confirms the news. Equifax pays a minimum of $575 million and that can go up to $700 million.