One day after it announced a data breach potentially affecting 143 million Americans, Equifax found itself on the other end of a federal class action complaint in Chicago.
On Sept. 8, Chicago resident Sean Neilan filed a complaint against Atlanta-based Equifax LLC, as a result of the July 29 discovery of unauthorized access to the credit reporting agency’s databases. The company announced the vulnerability Sept. 7, saying criminals accessed files from mid-May through the end of July, including names, Social Security numbers, birthdates, addresses and driver license numbers of millions of people.
The lawsuit is roughly similar to a class action lawsuit filed in Oregon federal court over the data breach on Sept. 7, the same day Equifax revealed the breach.
Neilan said he used a tool on the company’s website to determine the breach affected him and then filed the complaint because he “suffered from the deprivation of the value of his private information and will incur future costs and expenditures of time to protect himself from identity theft.”
According to the complaint, Equifax has information on more than 800 million people worldwide, and Neilan suggested high-profile data breaches involving Anthem, Yahoo and its competitor Experian means Equifax should have known it was a prime target for hackers.
“In fact, it makes many millions of dollars in profits convincing Americans to buy their credit protection and identity theft monitoring services to guard against such breaches and the damages they cause,” the complaint stated. “Despite this, Equifax failed to take adequate steps to secure its systems.”
He further took issue with Equifax for establishing a website ostensibly to provide free identity theft protection and credit monitoring, while in reality “it is being offered in exchange for waiving significant legal rights, including the Constitutional right to a jury trial, as described in the fine print on the hyperlinked ‘terms’ page, which, among other things, purports to bind users to individual arbitration,” preventing them from pursuing class action litigation.
The complaint also pointed out Equifax waited more than a month from the discovery of the breach to make a public announcement. Neilan cited a Wall Street Journal report stating personal data is a “new form of currency” that supports an online advertising industry in the United States worth $26 billion per year.
Neilan formally accused Equifax of willful failure and negligent failure to comply with the Fair Credit Reporting Act because it failed to develop or maintain procedures designed to prevent such a breach, as well as failing to adequately investigate suspicious circumstances or reasonably monitor customers’ acquisition and use of consumer reports.
He also alleged violation of the Illinois Consumer Fraud Acts deceptive and unfair business practice provisions and the Illinois Personal Information Protection Act’s requirements to provide expedient notice of a security breach and to implement and maintain reasonable security measures. He also made a general negligence allegation.
In addition to a jury trial and class certification, Neilan wants the court to order Equifax to pay actual, statutory and punitive damages of at least $5 million and to issue an injunction shutting down the website that purports to offer protection, but instead solicits acceptance of binding arbitration.
Representing Neilan in the matter, and seeking to serve as putative class attorneys, is the Chicago firm of Barnow and Associates, P.C.