San Francisco is first city to sue Equifax over data breach

SAN FRANCISCO — San Francisco filed a lawsuit on Tuesday against Equifax, becoming the first city in the country to sue the credit reporting company over a massive data breach that exposed the personal information of about 143 million Americans.

The city’s lawsuit in a California court accuses Equifax of violating state law by failing to implement reasonable security measures and not providing timely notice of the breach. It seeks tens of millions of dollars in civil penalties as well as restitution for some consumers.

“Equifax’s incompetence would be comical if the subject matter weren’t so serious,” San Francisco City Attorney Dennis Herrera said in a statement. “This company fell asleep at the switch and upended the lives of millions of people.”

Equifax declined to comment on the pending litigation, but says it remains focused on helping its customers.

The state of Massachusetts has also sued Equifax over the breach. The company, additionally, is facing consumer lawsuits as well as scrutiny from Congress. San Francisco’s lawsuit was filed on the same day that Equifax chief executive Richard Smith stepped down.

The hack exploited a software flaw that the company did not fix, exposing Social Security numbers, birthdates and other personal data that provide the keys to identify theft.

The break-in occurred from May 13 through July 30, according to the company. Equifax said it did not understand the breadth of information that had been stolen until shortly before issuing a public alert on Sept. 7.