The Equifax lawsuit is the consumer class action that followed the company’s 2017 data breach, which exposed personal information belonging to roughly 147 million Americans. It settled in early 2020 for at least $575 million, including a consumer restitution fund of up to $425 million and a requirement that Equifax spend at least $1 billion overhauling its data security. The window to file a claim closed on January 22, 2024, and the settlement administrator sent a final round of approximately $70 million in payments to eligible claimants between November 7 and December 20, 2024. Two benefits still remain open to affected consumers: free identity restoration services through January 11, 2029, and seven free Equifax credit reports per year through 2026.
What Triggered the Lawsuit
Attackers broke into Equifax’s online consumer dispute portal on May 13, 2017, by exploiting a known vulnerability in Apache Struts. The flaw had been publicly disclosed two months earlier, and U.S. cybersecurity authorities had told Equifax to patch it the very next day. The company did not. Intruders operated inside Equifax’s systems for 76 days without detection, in part because a network-monitoring device had an expired security certificate that had gone unrenewed for 19 months.1U.S. House Committee on Oversight and Government Reform. Equifax Report
Equifax discovered the intrusion on July 29, 2017, and publicly announced it on September 7, 2017. A subsequent review in early 2018 raised the total number of affected individuals to approximately 148 million. The compromised data included Social Security numbers, dates of birth, addresses, driver’s license numbers, credit card numbers, and dispute documents.1U.S. House Committee on Oversight and Government Reform. Equifax Report
The Settlement
Consumer lawsuits were consolidated into a multidistrict proceeding in the U.S. District Court for the Northern District of Georgia (Case No. 1:17-md-02800) before Chief Judge Thomas W. Thrash Jr.2DiCello Levitt. Attorneys Secure Preliminary Approval of Historic Settlement for Consumers Impacted by 2017 Equifax Data Breach The Federal Trade Commission, the Consumer Financial Protection Bureau, and attorneys general from 48 states, the District of Columbia, and Puerto Rico ran parallel enforcement actions. All of it resolved together in a global settlement announced on July 22, 2019.3FTC. Equifax to Pay $575 Million as Part of Settlement With FTC, CFPB, and States Related to 2017 Data Breach
The headline figure was at least $575 million, potentially rising to $700 million, split as follows:
- Consumer restitution fund: $300 million up front, with an additional $125 million available if claims exceeded the initial pool, for a total of up to $425 million. This fund covered cash payments, credit monitoring, identity restoration services, administrative costs, and attorneys’ fees.3FTC. Equifax to Pay $575 Million as Part of Settlement With FTC, CFPB, and States Related to 2017 Data Breach
- CFPB civil penalty: $100 million.4CFPB. CFPB, FTC, and States Announce Settlement With Equifax Over 2017 Data Breach
- State payments: $175 million shared among the 48 states, D.C., and Puerto Rico.5DC Office of the Attorney General. 50 Attorneys General Secure $600 Million From Equifax
- New York DFS fine: $10 million paid separately for violations of state financial services law.6NY DFS. DFS Fines Equifax $10 Million
Equifax was also required to spend at least $1 billion over five years overhauling its data security and technology.2DiCello Levitt. Attorneys Secure Preliminary Approval of Historic Settlement for Consumers Impacted by 2017 Equifax Data Breach7Classaction.org. Judge Says Equifax Settlement Provides More Than Consumers Would Get in Court8U.S. Court of Appeals for the Eleventh Circuit. In re Equifax Inc. Customer Data Security Breach Litigation, No. 20-102499Equifax Breach Settlement. Equifax Data Breach Settlement
What Claimants Received
Affected consumers had a choice: enroll in free credit monitoring, or, if they already had monitoring, take an “alternative cash payment” of up to $125. Cash and time-spent claims were initially capped at a combined $62 million. Far more people claimed than the structure could support, so payments were, as the settlement’s own FAQ puts it, “substantially lowered” to a “small percentage” of each initial claim.10Equifax Breach Settlement. Equifax Breach Settlement FAQ Some claimants reported receiving as little as $2.64 or $5.21 instead of the advertised $125.11Business Insider. Equifax Settlement Payment Explained Claimants who documented actual out-of-pocket losses from breach-related fraud did better; the FAQ states many of those payments exceeded $100.
After the extended claim period closed on January 22, 2024, leftover money in the restitution pool lifted the original dollar caps, and settlement administrator JND Legal Administration began sending pro-rata top-up payments via electronic prepaid cards.10Equifax Breach Settlement. Equifax Breach Settlement FAQ A final distribution round ran from November 7 through December 20, 2024, sending approximately $70 million to remaining eligible claimants.12Equifax. Equifax Statement on Settlement Administrator Distributing Final Payments No further payment rounds have been announced, and no new claims are being accepted.
Benefits Still Available
Even with the claim deadline closed, two benefits remain active for anyone affected by the breach, regardless of whether they filed a claim.
- Free assisted identity restoration services are available until January 11, 2029, seven years from the settlement’s effective date. Eligibility can be confirmed using the look-up tool on the settlement website.9Equifax Breach Settlement. Equifax Data Breach Settlement
- All U.S. consumers can request seven free Equifax credit reports per year through 2026 at www.annualcreditreport.com.13FTC. Equifax Data Breach Settlement
How to Spot Equifax Settlement Scams
Because prepaid cards are still arriving by mail and email notices about additional funds are still going out, scammers have moved in. The FTC has published clear identifiers for real communications.
Legitimate emails come only from distribution@equifaxbreachsettlement.com or info@equifaxbreachsettlement.com. The official website is www.EquifaxBreachSettlement.com, and the official phone number is 1-833-759-2982.13FTC. Equifax Data Breach Settlement No one connected with the settlement will call, text, or email you to ask for credit card or bank account numbers, and no fee is ever required to receive settlement benefits. Anyone asking for either is running a scam.14FTC. Did You Get an Email or Letter About the Equifax Settlement Suspected scams can be reported at ReportFraud.ftc.gov.
Other Equifax Legal Actions
Several other cases share the Equifax name but are separate from the consumer breach settlement and did not put money in consumer pockets.
An investor securities fraud class action, In re Equifax Inc. Securities Litigation, settled in February 2020 for $149 million; the fund has been fully disbursed to shareholders, not to breach victims.15Bernstein Litowitz Berger & Grossmann. In re Equifax Inc. Securities Litigation The SEC and federal prosecutors charged former Equifax executive Jun Ying in March 2018 with insider trading for selling nearly $1 million in stock before the breach was announced.16SEC. SEC Charges Former Equifax Executive With Insider Trading The Justice Department indicted four members of the Chinese People’s Liberation Army on February 10, 2020, for the intrusion itself; none of the four have been apprehended.17FBI. Chinese Hackers Charged in Equifax Breach
Separately, on January 17, 2025, the CFPB issued a new consent order against Equifax and imposed a $15 million civil penalty for systemic failures in how the company handled consumer credit disputes. The Bureau found that Equifax ignored evidence consumers submitted, relied on creditors instead of conducting its own investigations, sent confusing letters about dispute results, allowed previously deleted inaccuracies to reappear, and used flawed software code that miscalculated credit scores for hundreds of thousands of consumers.18CFPB. CFPB Orders Equifax to Pay $15 Million for Improper Investigations of Credit Reporting Errors Equifax agreed to the order without admitting or denying the findings.19CFPB. CFPB Equifax Consent Order The 2025 penalty is a government fine, not a fund from which individual consumers file claims.
A proposed class action on behalf of Canadian consumers affected by the breach was certified by the Ontario Superior Court of Justice on November 18, 2025. Equifax filed its statement of defence in July 2025, and no settlement or judgment has been reached.20Sotos Class Actions. Equifax That case applies only to Canadian consumers; it has no effect on the closed U.S. settlement.