The chief judge of the U.S. District Court for the Northern District of Georgia recently ruled that several consolidated lawsuits against Equifax over the data breach that occurred in 2017 may move forward. The lawsuits were filed by 96 people on behalf of a proposed class of all consumers whose personal and financial data was stolen in the breach.
The data breach affected more than 146 million consumers—nearly half of all Americans. Over a three-month period in 2017, cybercriminals stole at least 146.6 million names, dates of birth, and 145.5 million Social Security numbers, as well as 99 million addresses, 17.6 million driver's license numbers, 209,000 credit card numbers, and 97,500 tax identification numbers.
Lawyers for Equifax argued that exposure of personal information was not an injury and that the data breach had not led to any "actual harm" and only "speculative future harm." The chief judge disagreed because the affected consumers allege they have been harmed either by experiencing identity theft or by having to take measures to protect themselves from the "serious and imminent risk of fraud and identity theft" they all face as a result of the breach.
The chief judge was not convinced by Equifax's argument that it could not foresee criminal acts committed by outside parties and should not be liable for them. The judge noted that Equifax made public statements showing that it knew its data was valuable to cybercriminals and susceptible to hacking. Equifax had experienced previous breaches and ignored warnings from cybersecurity experts that its systems were "dangerously deficient" and faced "a substantial risk of an imminent breach," according to the judge.
The chief judge called the data breach "unprecedented" and rejected Equifax's request to dismiss the lawsuits. He concluded that "Equifax owed the plaintiffs a duty of care to safeguard the personal information in its custody." He stated that the "defendants knew of a foreseeable risk to its data security systems but failed to implement reasonable security measures." Robin McDonald "Judge OKs Equifax Lawsuits Over Massive Data Breach" law.com (Jan. 28, 2019).