Summit Credit Union sues Equifax

It says it may pay for fraudulent activity

One of Wisconsin’s largest credit unions has filed a lawsuit against Equifax, alleging the credit bureau “utterly failed” at protecting consumers’ most sensitive personal and financial information in a huge data breach.

Summit Credit Union, based in Madison, is seeking class-action status for the suit.

The credit union said that in addition to putting consumers’ private data at risk, the hack into Equifax records could mean financial institutions will have to cover the costs of fraudulent activity on their customers’ accounts and fake accounts resulting from identity theft.

According to Equifax, the breach potentially involves the personal information of 143 million American consumers — mainly their names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers.

“With the complete data sets that hackers have now acquired from the Equifax breach, criminals can use these stolen identities or create a new identity from scratch,” Summit asserted in its lawsuit. “They can then use this identity to apply for new lines of credit, loans, or other accounts with financial institutions. Financial institutions are responsible for all charges to these fraudulently opened accounts.”

Summit, which filed the lawsuit Sept. 11 in federal court in Atlanta, where Equifax is based, said losses associated with newly opened accounts only increase over time.

“When complete consumer profiles have been compromised, financial institutions experience continuous losses as identity thieves move on from one consumer profile to the next,” Summit stated in its 37-page lawsuit. “With a breach of this magnitude, there is virtually no limit to the amount of fraudulent account openings financial institutions may face.”

Summit said financial institutions face other costs as well, such as replacing credit and debit cards. The breach also has left financial institutions without a vital source of verifying consumer identities.

In a statement Friday, Kim Sponem, president and chief executive of Summit, said, “Financial institutions often incur the costs of fraud due to others’ data breaches. Equifax may be the largest compromise in U.S. history and we believe Equifax should cover any losses incurred due to their breach.”

Asked about the Summit lawsuit, Equifax said in a statement Friday: “We cannot comment on pending litigation, but we remain focused on helping our customers, as well as their employees and consumers, to navigate this situation.”

Minneapolis attorney Stacey Slaughter, of the firm Robins Kaplan LLP, who filed the lawsuit on behalf of Summit, said the Equifax case is “unprecedented in its size, magnitude and nature of information stolen.”

“It is a watershed case that will change the way we look at data breaches going forward,” Slaughter said in a statement.