The City of Chicago announced it has settled a lawsuit against Equifax over a data breach that jeopardized the personal information of more than 40% of the U.S. population.
In a statement this week, the city’s Law Department said it reached a $1.5 million compromise with the national credit bureau after a hack three years ago left names, social security numbers, birthdays and other sensitive information vulnerable for months.
“This settlement represents a significant achievement by the law department, which worked hard on this matter to enforce [c]ity law protecting against unfair business practices,” said Mark Flessner, city corporation counsel, in the release.
The digital attack on the agency was conducted between May and July of 2017. The Department of Justice earlier this year indicted members of the Chinese military for carrying it out.
The company didn’t announce the intrusion until later that year, in early September, stating that it affected around 143 million citizens, before revising that number up to about 148 million.
The city filed a 26-page complaint in Cook County Circuit Court at the end of that month, alleging the company violated a state data privacy law and a local consumer fraud ordinance.
It claimed the company should have done more to protect people’s information and failed to implement industry-standard safeguards, contrary to what it was telling the public.
City officials announced the suit at a Sept. 28, 2017 press conference, citing an ordinance with damages of up $10,000 per resident for each day the company didn’t notify them of the hack. At the time, the company still hadn’t informed residents of the attack personally.
“As far as we’re concerned, based on the ordinance and the laws of the state of Illinois, the clock is still ticking,” then-corporation counsel Edward N. Siskel said.
The company agreed last year to pay the Federal Trade Commission around $650 million to settle a nationwide investigation prompted by multiple state attorneys general, and a national multidistrict suit brought by private plaintiffs’ lawyers against the company settled last year for approximately $1.5 billion.
According to the Law Department statement, Chicago and the District of Columbia are two of the only municipalities to receive a settlement over the data breach with Equifax.
Equifax has not responded to a request for comment on the settlement.