Equifax Lawsuit 2025: CFPB Order, NY Settlement, and Payouts

Two enforcement actions defined the Equifax lawsuit picture in 2025: on January 17, the Consumer Financial Protection Bureau ordered Equifax to pay a $15 million civil penalty for mishandling consumer disputes about credit report errors, and three days earlier, on January 14, New York Attorney General Letitia James announced a $725,000 settlement over a 2022 coding error that falsely lowered credit scores for more than 76,000 New Yorkers. Both came after the final round of consumer payments from the 2017 data breach settlement went out in late 2024, closing that chapter for most claimants.

The CFPB’s $15 Million Order Over Dispute Investigations

The CFPB’s consent order (Docket No. 2025-CFPB-0002) found that Equifax had violated both the Fair Credit Reporting Act and the Consumer Financial Protection Act in the way it investigated consumer disputes going back to at least October 2017. Along with the $15 million penalty, the order requires Equifax to bring its dispute processes into compliance with federal law.¹

The failures the agency identified are the sort of thing a consumer would recognize from their own experience trying to fix a credit report:

Equifax relied almost entirely on automated replies from the banks and lenders that supplied the disputed data, rarely conducting an independent review even when the consumer submitted documents contradicting the furnisher’s position.²
The company lacked procedures to prevent inaccurate information it had already removed from reappearing on reports, and it failed to notify consumers when that reinsertion happened.³
Letters sent to consumers after investigations were contradictory, at times stating that disputed information had been both verified as accurate and deleted. Thousands of consumers were incorrectly told their bankruptcy had been “discharged” when it had actually been “dismissed.”²
Flawed software produced inaccurate credit scores for several hundred thousand consumers and caused duplicate reporting of credit accounts for more than 50,000 more. The agency traced one episode to “test code” that was mistakenly pushed into a live scoring system.¹

The $15 million is a civil penalty paid to the CFPB, not a consumer restitution fund. There is no claims process attached, and the order does not direct individual payments to affected consumers. As of the last recorded status on the CFPB’s enforcement page, the matter is listed as “Post Order/Post Judgment,” with no public indication that Equifax has appealed or that the order has been modified.³

New York’s $725,000 Settlement Over the 2022 Scoring Error

The New York settlement targeted a narrower, better-defined incident. Between March 17 and April 8, 2022, a code change in Equifax’s Online Model Server caused scoring models to use a static, outdated date instead of the current date when calculating credit scores. During that three-week window, more than 76,000 New York residents received falsely lowered scores. Some were denied credit or offered worse loan and insurance terms than accurate scores would have produced.⁴⁵

The $725,000 covers both penalties and restitution. The Attorney General’s office said it would contact New York consumers who had paid Equifax directly for credit score products during the affected period. Equifax had already reimbursed lenders and insurers who provided interest rate adjustments to affected borrowers.⁴

Under the settlement (Assurance of Discontinuance AOD 24-102, effective January 2, 2025), Equifax must update its technology change-control policies, require Change Advisory Board review for updates that could affect credit scores, maintain industry-standard code review before deployment, train developers on the Fair Credit Reporting Act’s accuracy requirements, and monitor customer incident reports at least weekly. Equifax did not admit wrongdoing.⁶ Consumers outside New York are not covered by this action.

The 2017 Breach Settlement: Payments Are Done

If you filed a claim from the original breach settlement, the money has already gone out. JND Legal Administration, the court-appointed settlement administrator, began distributing the final round of payments on November 7, 2024, with distribution scheduled to wrap up by December 20, 2024. That round covered roughly $70 million allocated for alternative compensation, out-of-pocket losses, and time-spent claims. Payments went by electronic prepaid card. The extended claims period for certain loss categories had closed on January 22, 2024, so new claims are no longer being accepted.⁷⁸

The underlying deal, approved on January 13, 2020 by Chief Judge Thomas W. Thrash Jr. of the U.S. District Court for the Northern District of Georgia, set up a consumer restitution fund of at least $380.5 million (with an additional $125 million available if the fund was exhausted), plus credit monitoring and identity restoration services. Because far more people filed claims than anticipated, cash payments for time spent and the alternative compensation option were reduced and paid on a proportional basis.⁹ Claimants who elected credit monitoring can still use it: the settlement provided at least four years of three-bureau monitoring through Experian and seven years of identity restoration services.

Other Litigation Still Moving

Two matters outside the 2025 U.S. enforcement actions are worth flagging because they remain active.

In Canada, a class action led by Sotos LLP in the Ontario Superior Court of Justice was certified on November 18, 2025. The class includes Canadian residents whose personal information was accessed in the 2017 breach and those who subscribed to Equifax credit monitoring between March and July 2017. Equifax filed its statement of defence in July 2025, and no settlement or judgment has been reached.¹⁰

In the United States, a separate Fair Credit Reporting Act class action against Equifax settled in the Eastern District of Virginia, with Judge Roderick C. Young approving the deal on May 28, 2026 and ruling that it was not tainted by collusion. The financial terms were not publicly disclosed.¹¹

What This Means If You’re an Equifax Consumer

None of the 2025 actions create a broad new payout comparable to the 2017 breach fund. The CFPB’s $15 million is a penalty, not restitution. New York’s $725,000 restitution component is limited to New York residents who paid Equifax for score products during a three-week window in 2022, and the state Attorney General’s office said it would reach out directly to eligible people.

What the 2025 orders do change is the standard Equifax must meet when you dispute an error. The CFPB’s findings targeted rubber-stamped investigations, reinserted errors without notice, and contradictory dispute-result letters. If you dispute an item on your Equifax report and get a result that looks like one of those patterns, the consent order gives you specific conduct to point to. You can pull your Equifax file, file a dispute directly with Equifax, and file a complaint with the CFPB if the response falls short. Federal law also allows you to sue a credit reporting agency under the Fair Credit Reporting Act for failing to conduct a reasonable investigation, which is the same statute the CFPB found Equifax had violated.

1
CFPB. CFPB Orders Equifax to Pay $15 Million for Improper Investigations of Credit Reporting Errors
2
CFPB. Equifax Inc. Consent Order
3
CFPB. Equifax Inc. and Equifax Information Services LLC
4
Office of the New York Attorney General. Attorney General James Secures $725,000 From Equifax for Harming Consumers
5
Newsday. Equifax Credit Rating Score
6
New York Attorney General. Assurance of Discontinuance
7
Equifax. Equifax Statement on Final Payments in the Data Breach Settlement
8
Equifax Breach Settlement. Equifax Data Breach Settlement
9
Equifax Breach Settlement. Frequently Asked Questions
10
Sotos LLP. Equifax
11
Law360. Judge Clears Settlement in Equifax Reporting Suit