Equifax Hit With 'Dozens' of Lawsuits from Shareholders and Consumers -- Plus a Possible Class Action (chicagotribune.com)

An anonymous reader quotes the Washington Post: Since it announced a massive data breach earlier this month, Equifax has been hit with dozens of lawsuits from shareholders, consumers and now one filed by a small Wisconsin credit union that represents what could be the first by a financial institution attempting to preemptively recoup losses caused by alleged fraud the hack could cause... In the lawsuit, which seeks class action status, Madison-based Summit Credit Union says that financial institutions will have to bear the cost of canceling and reissuing credit cards as well as absorbing the cost of any fraudulent charges. They will also lose "profits because their members or customers were unwilling or unable to use their credit cards following the breach," according to the lawsuit...

"For financial institutions it is important: They bear the financial responsibility for identity theft," said Summit's attorney Stacey Slaughter of the law firm Robins Kaplan. "All of the components that would allow someone to create a new identity" were exposed in the Equifax hack.
Equifax responded that they can't comment on pending litigation, according to the article, though "Equifax has said it did its best to respond to the breach and alerted consumers as quickly as it could..."

"The company's stock price has fallen 27 percent since it announced the hack September 7."

Comments

Let me be the one to say it

[Opportunist]

Good.

Disingenuous

[Anonymous Coward]

"Equifax has said it did its best to respond to the breach and alerted consumers as quickly as it could..." - You mean Equifax alerted consumers as quickly as they could after their executives sold their shares...

Pitiful. Hope they go outta business.

I'm not so sure

[rsilvergun]

The class action will let them pay some lawyer a fill million and basically get indemnified against all future damages. OTOH with how weak our consumer protection laws are class action is about the only thing keeping companies, well I wouldn't call it "honest"... maybe just barely sorta in check.

btw, if you're reading this and have been one of the ones railing against 'job killing regulations' (their words, not mine) this is the consequences of the relentless drive to stop government oversight in the name of freedom. Nobody ever cuts the rules about using squirrels for the purposes of gambling because those kind of silly laws are no longer enforced. They go after stuff that would punish Equifax for ignoring security.

"Quickly as they could"??? BS.

[SvnLyrBrto]

> "Equifax has said it did its best to respond to the
> breach and alerted consumers as quickly as it
> could..."

And by "as quickly as it could", Equifax means that they view sitting on the breach and keeping the public in the dark while the C-levels sell off their stock as being legitimate.

Banks and lenders must bear the liability

[140Mandak262Jamuna]

"For financial institutions it is important: They bear the financial responsibility for identity theft," said Summit's attorney Stacey Slaughter of the law firm Robins Kaplan. "All of the components that would allow someone to create a new identity" were exposed in the Equifax hack.

It is not my job to securely guard my name, address and social security number. It is, in fact, impossible to secure it. It is the bank's responsibility to make sure they lend to the right person. Banks can not lend to any one claiming to be A and hold A responsible for default.

If they lend to B and report A is in default, A should be able to sue the banks for libel.

The root cause of this identity theft market is the willingness of the banks to lend without doing full verification of the identity. If banks won't lend so easily, then there is no reason for people to steal identity. Banks want to lend freely, without any verification. They make us prove we did not borrow the money and we were victims of identity theft. It should not be our responsibility.

In fact they won't be able to collect in court if they sue us. The only weapon they have is to report us to be in default. Well, we need to take that weapon away from them. They should not be able to report default without first proving they lent to the person they allege to have defaulted on loans.

Re:Banks and lenders must bear the liability

[Mitreya]

They make us prove we did not borrow the money and we were victims of identity theft. It should not be our responsibility.

Yes, that. I hope the person who made up this misnomer "stolen identity" at least received a big bonus.
No one can steal identity. My identity remains intact. Banks just hand out money in my name, because someone said they are me and banks believed them.
Usually because that someone knows my SSN and my address/phone, which is out there now thanks to Equifax.

What? Just 27%?

[140Mandak262Jamuna]

"The company's stock price has fallen 27 percent since it announced the hack September 7."

Surprised it is still at 73% of old price. I would like it to go bankrupt and take the entire credit reporting industry down with it.

We need to make both the banks, and the credit reporting agencies responsible for any fraudulent information they might publish. Claim A is in default of a loan, without proof that it was A who actually borrowed, bank should be liable for libel. Report the bank's claim, the credit reporting agency should be held accessory after the fact, aider and abettor. That is the only way to clean up the mess.

Re:What? Just 27%?

[Mitreya]

Surprised it is still at 73% of old price. I would like it to go bankrupt and take the entire credit reporting industry down with it.

I also would like Equifax to go bankrupt.
However, I think stock price reflects the betting odds that nothing significant will come of it
My understanding is that
1) We are not even the customers of Equifax because someone else handed over our data to them and
2) People suing would have to show standing. So you probably have to wait until your "identity" is "stolen", then prove that it was due to Equifax breach (nearly impossible, of course), and then maybe you can sue.

Re:What? Just 27%?

[ArylAkamov]

So...buy their stock while it is low and wait a few months for this to blow over, then sell?

Criminal Charges Needed

[Roger W Moore]

This is why suing Equifax into oblivion is not enough because then the company and shareholders, not the executives responsible for the lack of security, suffer. What is needed are criminal charges against those in charge of this fiasco. It sounds like there is already an investigation into insider trading but what is really needed is charges related to data protection but I don't know if US law allows for that like it does in the EU and Canada.

Re: Criminal Charges Needed

[sound vision]

The share holders are investors who have volunteered to take a risk with their money. One of those risks is that they don't watch the business sufficiently and it gets ran incompetently then sued out of existence. I'm not sure it's perfectly just for the banks and lawyers to get the whole reward, but we can't bail out shareholders when their companies fail.

Re:Criminal Charges Needed

[dgatwood]

This is why suing Equifax into oblivion is not enough because then the company and shareholders, not the executives responsible for the lack of security, suffer. What is needed are criminal charges against those in charge of this fiasco. It sounds like there is already an investigation into insider trading but what is really needed is charges related to data protection but I don't know if US law allows for that like it does in the EU and Canada.

First, the shareholders should suffer. Equifax, like all of the credit bureaus, is a fundamentally flawed business model built upon the crazy notion that an identifier is somehow a way of proving your identity, rather than merely a fact about that identity. At their very core, these companies are the antithesis of security, and this has been obvious for decades. Yet they have done surprisingly little to shore up the gaping flaws in that business model.

The shareholders, knowing that credit fraud is a rapidly growing problem, chose to invest in a company whose business is built on the vain hope that credit fraud will remain a minor nuisance. They invested in it knowing that eventually it could come crashing down in a giant ball of flame. They chose to ride the stock up, hoping to ride a wave of excess credit and get out before the inevitable collapse.

This isn't the sort of company failure that deserves a bailout. It wasn't some bizarre fluke that was impossible to predict. Their entire business model breaks completely as soon as the majority of working Americans' SSNs become suddenly public, and the gradual loss of that secrecy has been glaringly obvious for a very, very long time. The only real question was whether one of the credit bureaus would be responsible for their downfall or some other group (e.g. the Social Security Administration). It was never a question of if; it was always a question of when.

To quote the movie Airplane, "Shanna, they bought their tickets. They knew what they were getting into. I say, let 'em crash." If you bail the stockholders out for investing in a company built on a fundamentally shoddy foundation, then you're just encouraging people to take unnecessary risks and buy stocks that they should know better than to buy. They played Russian roulette, and they lost. End of story. The only question left is how to dispose of the company's corpse.

As for the execs, though, criminal charges are not enough. We need to bring back public shaming in the court square. Stick them in the stockades and use a multi-trillion dollar fine against Equifax to pay for an endless supply of tomatoes so that anyone affected by the breach can exact their revenge. And live stream it worldwide so that these people can serve as an example to others about what happens when you amass vast quantities of personally identifying information without taking appropriate precautions to ensure that it remains safe.

Re: Criminal Charges Needed

[Roger W Moore]

The share holders are investors who have volunteered to take a risk with their money.

I agree that to some extent the shareholders should suffer. However, if we want to stop this sort of thing happening again those directly responsible for the actions that lead to it must be held accountable and not allowed to hide behind the company and shareholders. In addition, there is very little shareholders can do to stop things like this. They can't stop executives insider trading nor can they easily find out about the appalling lack of security - effectively they are also victims albeit ones who did put their money into it knowing the risks.

Normally I don't participate in class actions

[Solandri]

Too often, a class action lawsuit means the lawyers gets $xx million, I get a $3 coupon.

But in this case I'd participate just to screw with Equifax.