A cruel twist of irony has emerged as a kind of coda to the major 2017 Equifax data breach that resulted in hackers nabbing more than 200,000 payment card numbers and expiration dates and Equifax agreeing to a $700 million settlement with the FTC.
The original plan had been to offer victims of the data breach up to $125 as part of the settlement, along with an alternate offer of free credit monitoring. However, the portion of that $700 million dedicated to the direct cash payments to victims only totaled $31 million, and there were so many victims that the kitty quickly ran dry. But while plenty of victims have come up short in the Equifax settlement, banks (big surprise) are still getting paid -- to the tune of $5.5 million.
According to the London-based The Register, Equifax has hashed out an agreement to pay "all financial institutions in the United States" that issued a major credit card (so, Visa, Discover, Amex, or MasterCard) that was identified in the 2017 breach. As part of the agreement, Equifax is also pledging $25 million to be used to improve its data security.
As to the actual victims of the breach, the individuals themselves, the option to obtain cash from that minuscule portion of the overall settlement dried up pretty fast. To recap the chronology: The credit bureau was hacked more than two years ago now, and it's been almost a year since Equifax agreed to the settlement. A judge gave a final sign-off on the settlement in December, and then victims were given a deadline of January 22 of this year to apply for their portion of the settlement if they wanted the free credit monitoring (while victims who wanted a chunk of the cash were supposed to apply by October 15 -- which feels like a lifetime ago, pre-coronavirus pandemic.)
However, it doesn't appear that Equifax has started sending out those settlements (which, again, are a max of $125 per person), and we don't have a clue at this point when they'll start doing so.
Back at the end of July, well before that October deadline to apply for the cash, the credit reporting agency distributed an urgent announcement to the public that the pool of Equifax settlement funds used to pay cash claims to victims was running low and that victims should probably steer toward a non-cash alternative. “This is unacceptable,” one person wrote in a comment on the FTC’s post. “The court and Equifax knew there were 147 million claimants. Why offer $125 per claim and set aside only $31 million? Did someone forget to do the math?”
Wrote another commenter: "Why would anyone want free 'credit monitoring' from the company that lost the info in the first place? Seems to give them much too easy a way out."