The city of Chicago says it will receive $1.5 million from Equifax, as payment to settle the city’s claims the credit reporting bureau violated a city ordinance in the way it handled a massive data breach three years ago.
The city’s Department of Law announced the settlement with the credit bureau in a release posted to the city’s website.
“This settlement represents a significant achievement by the law department,” said Chicago Corporation Counsel Mark Flessner, noting the city’s efforts “to enforce City law protecting against unfair business practices.”
The city had filed suit in 2017 in Cook County Circuit Court, accusing Equifax of violating the city’s Consumer Fraud, Unfair Competition or Deceptive Practices Ordinance.
Particularly, the city said Equifax had “left at least 143 million individuals’ sensitive and private information exposed and vulnerable to intruders by relying on open-source code … that Equifax knew or should have known was insecure and subject to exploitation.”
In its complaint, the city asserted at least 5.4 million Illinoisans were among those whose data was allegedly exposed in the Equifax data breach between March 7 and July 30, 2017.
The city further asserted Equifax waited too long to tell customers of the breach, and never provided disclosure notifications to Chicago residents as required by the Illinois state law and the city ordinance.
According to the complaint, statutory fines for violating the city ordinance for each of the three counts were between $2,000-$10,000 per day for each violation involving potentially millions of Chicago residents.
The city asserted it was entitled to restitution of $10,000 per day for Equifax’s alleged deceptive practices, as well, under state law.
Other local governments, including the city of San Francisco, also sued Equifax.
However, of those cities and other local governments, thus far, only Chicago and the District of Columbia have collected payments for the data breach, the city said in its statement.
Equifax has settled with the federal government, state governments and private plaintiffs over the data breach, including paying $1.5 billion to settle a national action by private plaintiffs and $650 million to settle claims raised by the federal government and state attorneys general.