Cybersecurity - Equifax sued over massive data breach

Cybersecurity Equifax sued over massive data breach

Second case brought against company for way it handled personal info

ATLANTA  - A team of lawyers has filed a class-action lawsuit against Equifax over that data breach that has compromised the personal information of more than 140 million US consumers.

The lawsuit filed in US District Court in Atlanta faults Equifax for "gargantuan failures to secure and safeguard consumers' personally identifiable information -- and for failing to provide timely, accurate and adequate notice" to consumers that such sensitive material had been stolen.

The lawsuit said plaintiffs Brian Spector of Florida and James McGonnigal of Maryland are each victims of the breach.  McGonnigal alleges he has "recently had four credit accounts opened in his name without his authorization."  

The lawsuit joins another filed this past week in Oregon on behalf of a couple there, and others are expected.  A US House committee has called for hearings, and the FBI reportedly is investigating the breach.

A message left with representatives of the Atlanta-based credit reporting and technology company Saturday was not immediately returned.

The Atlanta case calls Equifax reckless in its handling of consumers' data, and also said the company did not disclose why there was more than a month's delay in making the breach public.  It cites the sale of stock by three executives days after Equifax learned of the breach, but weeks before the company alerted consumers to the theft.  

Three executives -- chief financial officer John Gamble; Joseph Loughran, who heads Equifax" US information solutions business; and Rodolfo Ploder, who runs the company's workforce solutions business sold nearly $1.8 million in stock in the days after Equifax discovered the cyberattack.

The sales were not part of a scheduled sale, and Equifax said the three executives "had no knowledge that an intrusion had occurred at the time."

But the company told its investors that it had "promptly" informed its board of directors of the incident.

The complaint contends the breach "was the inevitable result of Equifax's inadequate approach to data security and the protection."The Atlanta lawsuit seeks statutory damages under the federal Fair Credit Reporting Act and state statues and other out-of-pocket losses and compensatory damages, as well "more robust credit monitoring services with accompanying identity theft insurance." 

The plaintiffs also seek an order from the court requiring the company to improve its data security.

Equifax has taken heat from consumer groups for fine print in the credit and identity protection package it has offered for free to consumers hit by the breach.  The fine print appears to bind consumers who agree to use the free products to arbitration, essentially giving up their rights to sue the company or join a class action case.

Equifax said in a prepared statement Friday that the arbitration clause doesn't apply to the breach, but only to disputes that might arise with the free protection services.