Not exactly. If it were possible for all of the affected to individually sue Equifax, many of them already would have. But the US civil-legal system requires

Not exactly. If it were possible for all of the affected to individually sue Equifax, many of them already would have. But the US civil-legal system requires "standing", which in turn requires proof of "damages". The sad fact is that loss of sensitive information is not quantifiable as "damages" for this purpose, even though that same information is worth well north of $millions when the FEC looks at the same kind of information transaction in election campaigns. "The markets" that fiscal conservatives love to talk about don't work when our civil system doesn't recognize that there is value and a market there. If the data breach had resulted in masses of data being traded on the black market, the Equifax breach may have ended in prosecutions and massive lawsuits. Because it didn't, it likely won't end in much. Hell, not even the banks, retailers, and ID security services that did business with Equifax bothered to make a big deal about cancelling their contracts+relationships. The sad fact is that there's a tiny pool of companies with this data and cutting off one company gives the other players (who aren't much better at securing their networks) massive leverage.