Equifax data breach leads to class action suit in federal court

A massive data breach by the credit reporting firm Equifax affecting more than 140 million Americans has led to the filing of class action lawsuits across the country and in a Texarkana federal court.

The suit was filed Friday in the Texarkana Division of the Western District of Arkansas and seeks to represent anyone whose personal identifying information in Equifax's possession was hacked from May to July. The complaint, filed by the Little Rock firm Steel, Wright, Gray & Hutchinson and the Nashville, Tenn.-based Sanford Heisler Sharp firm, identifies both a national class of potential plaintiffs and an Arkansas class of potential plaintiffs and names Prescott, Ark., resident Roshunda Gulley as the class representative.

Equifax discovered that a flaw in its U.S. website allowed hackers to access extremely sensitive data beginning in May until the breach was discovered July 29, according to the complaint and Equifax's website. The company didn't announce the breach publicly and to potential identity theft and fraud victims until Sept. 7. According to the complaint and national news reports cited in it, high-ranking Equifax executives dumped millions of dollars worth of shares in the company before the September announcement in anticipation of falling stock prices.

Personal information stolen by hackers includes names, dates of birth, social security numbers, addresses and in some cases drivers license numbers and credit card numbers, according to the complaint.

“Armed with the stolen information, unauthorized third parties now possess keys that unlock consumers' medical histories, bank accounts, employee accounts, and more,” the complaint states. “Criminals can take out loans, mortgage property, open financial accounts and credit cards in a victim's name, obtain government benefits, file fraudulent tax returns, obtain medical services, and provide false information to police during

an arrest, all under the victim's name.”

Instead of spending their hours working or enjoying time off, data breach victims must budget time and money to monitor their accounts, register for credit protection services and if necessary, file police reports.

“This time has been lost forever and cannot be recaptured,” the complaint states. “In all manner of life in this country, time has constantly been recognized as compensable, and even if retired from the work force, consumers should be free from having to deal with the consequences of a credit reporting agency's wrongful conduct, as is the case here…Plaintiffs and class members will likely spend considerable effort and money for the rest of their lives on monitoring and responding to the repercussions of this cyber attack.”

Equifax should have known it was vulnerable to hacking as smaller breaches occurred in 2013, 2016 and in January 2017, according to the complaint. The complaint alleges that a company that markets itself as an expert in data security should have done more to protect consumers. The complaint accuses Equifax of violating the Federal Fair Credit Reporting Act, of negligent violations of the FFCRA, of negligence, of breach of implied contract, of unjust enrichment, invasion of privacy and more.

The complaint alleges that personal identifying information in Equifax's possession is presently in even greater danger as cyber thieves now know the company's databases are an easy target. The five week delay in notifying the public that the information had been stolen prevented data breach victims from taking proactive steps to protect themselves, according to the complaint.

The complaint seeks a declaratory judgment that Equifax has failed in its duty to protect the information with which it is entrusted and that it should be forced through an injunction to undergo regular third-party auditing to identify security problems. Also sought are damages for all those affected including the costs of identity protection and the cost of fighting identity theft and fraud.

A note on the case docket indicates a copy of the complaint has been forwarded to the federal panel on multi-district litigation. The case could be consolidated with a plethora of similar ones and handled in a single court to insure rulings are consistent and to promote economical use of the federal judicial system. For now the case is assigned to U.S. District Judge Susan Hickey. Equifax has not filed a response.