The Washington PostDemocracy Dies in Darkness

Equifax faces hundreds of class-action lawsuits and an SEC subpoena over the way it handled its data breach

(Dado Ruvic/Illustration/Reuters)

Equifax, the credit reporting firm, is facing more than 240 class-action lawsuits from consumers — in addition to suits from shareholders and financial institutions — over the way it handled a massive data breach that affected 145.5 million Americans.

The lawsuits were detailed in the company's third-quarter earnings report Thursday, its first since revealing the breach in September. The incident prompted three top officials to leave the company, including former chief executive Richard Smith.

Equifax also said in its filings that it had received subpoenas from the Securities and Exchange Commission, as well as the U.S. Attorney’s Office for the Northern District of Georgia “regarding trading activities by certain of our employees in relation to the cybersecurity incident.” Shortly after news of the breach broke, reports circulated that top officials had sold Equifax stock after the company found out about the breach, but before disclosing it to the public. Equifax said this week that it had cleared its executives of wrongdoing after an internal investigation found that the executives did not personally know about the breach before their stock sales.

To date, SEC Chairman Jay Clayton has not confirmed or denied that the SEC is investigating those executives for insider trading, according to the Associated Press.

The credit bureau is also facing more than 60 government investigations from states, U.S. federal agencies and the British and Canadian governments, the earnings report revealed.

Equifax estimates that the breach-related costs will total $87.5 million, including the cost of the free credit-monitoring services it provides to breach victims. The company said it did not know how much it would cost them to address any judgments, settlements or penalties as a result of the breach.

“As we report our third-quarter results, we recognize that we have an important journey in front of us to regain the trust and confidence of consumers and our business customers,” said Paulino Barros, Equifax's interim chief executive in the release. “Our teams have taken immediate actions to improve our data security and provide improved support for consumers who were impacted by our cybersecurity incident.”

Equifax reported $834.8 million in revenue in its third quarter, which is up 4 percent from the same time last year; analysts had expected this, as the bulk of the company's money comes from selling services to other business, not consumers. Profits, however, were down 27 percent from the previous year at $96.3 million — in large part due to the breach.

Shares of Equifax, which have fallen more than 20 percent since the breach, took another hit after the report, down as much as 3 percent from its market close of $108.95. As of time of writing, shares were trading slightly down at $108.50.