7 ms·
Equifax Is Said to Be Near $650M Settlement for Data Breach
- nafizh 7y agoThis is ridiculous. They just continue as if nothing happened. And who gets the money? What about the consumers who got affected? Where is the compensation for them?
- cameronbrown 7y agoThe damage to each individual is incalculable. Their company should just be dissolved and split between everyone affected at this point. Giving them a fine even close to the amount of economic damage they did would already be the end of the company.
- deleted 7y ago[deleted]
- throwaway2048 7y agoSplitting the company would just mean selling the data (the only valuable asset they have) to somebody else, whoever would pay the most.
- MereInterest 7y agoWhy? Breaches like Equifax happen when companies treat data, especially personal data, as an asset rather than a liability. Treat their database as the toxic asset that it is, and delete it as part of the bankruptcy.
- buzzerbetrayed 7y agoThen what do you sell? You can’t sell the company and distribute the money to the affected people if you make the company worthless first.
- cameronbrown 7y agoThey've already shown themselves to be terrible stewards of that data. If it was sold due to their bankruptcy then whoever buys it is going to be much more careful about losing any of it.
- tuxxy 7y agoI took Equifax to small claims. When that didn't pay up, I appealed and removed to higher courts. I continued doing this until it wasn't worth it for me. I think I cost Equifax a total of at least $20K USD. They had to keep flying lawyers back and forth from Atlanta to where I lived and put them in hotels. I think I got them to spend more than I would have received in any settlement. Fun note, my judge in small claims dismissed my case but said the following before dismissing it, "Mr. tuxxy, I would not trust Equifax with my dog's vaccination records. I'm absolutely appalled in the lack of protections Equifax provides for the personal data of Americans, however I'm afraid I don't see a case for negligence..." She lectured Equifax's lawyers a bit on what a shitty offer credit monitoring was for the loss of my PII for a bit, then sent us out. I trolled their legal team a bit near the end and tried to settle for $3.50 after mediation failed, but I wanted them to refer to the $3.50 as "tree-fiddy" in the settlement, but they refused. Oh well...
- felipemnoa 7y agoSounds like your story would be a good article to read.
- cameronbrown 7y agoYup. Would love to hear all the details.
- tuxxy 7y agoI can write about it on my personal website. Maybe I'll submit it here some time. I'm afraid it's not that interesting other than the emails of me trolling them. I wish more people took them to court. It was not difficult to do and is quite an effective form of direct action because they have to spend quite a bit of money to fight it.
- dangoldin 7y agoThat can be a helpful part of the writeup. I'm sure it would motivate a bunch of us to actually do that.
- DiabloD3 7y agoI think they forgot at least three zeros in that number.
- scythe 7y agoWhen corporate fines are shown in headlines, I think they should be expressed as a % of market capitalization or cash on hand (the latter % obviously being much bigger). It helps the reader better understand what kind of action was taken. Fining McDonald’s 10M and fining Mozilla 10M will have radically different effects.
- harryh 7y agoEquifax is currently worth about 16.6B. This takes into account the fine, so without the fine they'd presumably be worth 17.25B or so. So this was a fine of 3-4% of their market cap. Total costs associated with the breach were probably moderately higher than that. That being said, it's important to understand that in the US, penalties are assessed based on the seriousness of the infraction, not on the ability of the perpetrator to pay. And while it might be the opinion of lots of HN commenters that the equifax breach caused "incalculable" harms, demonstrating this level of harm in court would be tremendously difficult.
- nerdponx 7y agoThat being said, it's important to understand that in the US, penalties are assessed based on the seriousness of the infraction, not on the ability of the perpetrator to pay. It's not about ability, it's about whether the fine is a suitable punishment and deterrent.
- harryh 7y agoThat being said, it's important to understand that in the US, penalties are assessed based on the seriousness of the infraction, not on whether the fine is a suitable punishment and deterrent.
- pmiller2 7y ago> ...in the US, penalties are assessed based on the seriousness of the infraction, not on the ability of the perpetrator to pay. When the penalty is less than $5 per person affected, how am I expected to take that seriously? A penalty based on the actual seriousness of the infraction would put the company out of business, and that's what should have happened.
- FlyingLawnmower 7y agoI don't understand how Facebook got a $5B fine, yet Equifax gets a ~$650m fine. The data breached in the Equifax case seems to cause far more direct harm, and affected many more Americans. It feels like the 10x difference should go the other way. Can someone more educated in how these fines work teach me about how these numbers are calculated?
- cameronbrown 7y agoProbably because FB is politically charged, disliked by both parties, consumers and the wider industry. The fine represents the public's anger at large.
- samstave 7y ago" You're good, You're good, You're good, You're good, FUCK YOU IN PARTICULAR You're good, You're good, You're good,"
- paulddraper 7y agoAnd Equifax ISN'T?
- cameronbrown 7y agoLet's be honest, the average American barely knows what Equifax is.
- pmiller2 7y agoLet's be even more honest: if they did know what Equifax is, what they do, and how long they've been doing it, they would certainly hate them more than Facebook.
- ineedasername 7y agoLooks like you got downvoted a bit on this, but it's an excellent point. I fully think FB deserved what they got, and would not have balked at more. But Equifax, even with a fine higher than FB's relative to market cap, still seems to have gotten off lighter.
- TomMckenny 7y agoSo when will I be able to opt out of their tracking me?
- frankchn 7y agoThat’s the beauty of their business model — you can only opt out by opting out of most of banking altogether.
- simonswords82 7y agoThese guys are scumbags. Check out point 12 on this page: https://www.equifax.co.uk/ein.html https://www.equifax.co.uk/ein.html With GDPR now in place here in the UK you can write to an organisation and ask them to delete all your data. It would appear Equifax is above this new law... > Please note that given the importance of complete and accurate credit records, for purposes including for responsible lending, it will usually be appropriate to continue processing credit report data -in particular, to protect the rights of another natural or legal person, or because it’s an important public interest of the union or member state.
- asdff 7y agoOpting out of US banking that is. This isn't a thing elsewhere.
- sys_64738 7y agoMy info is only worth $4.50?
- zadokshi 7y agoWhat is the market value of your data on an open market? It might be less than $4.5
- deleted 7y ago[deleted]
- 6nf 7y agoWhat was the level of detail exposed for the average person affected by the breach? Name, address, age etc? That stuff has to be worth more than $4.5.
- solarkraft 7y agoIt might be worth 0.10$ to an advertiser, but that's not the damage you have if that data goes public, which the settlement is supposed to value.
- lawtalkinghuman 7y agoThat's about $4 more than some of the pre-GDPR settlements in various European countries...
- Canada 7y agoYeah, it should be at least $100 billion. The damages should completely wipe out all existing shareholders, and the company should be unable to continue as a going concern.
- chias 7y ago> The damages should completely wipe out all existing shareholders Do you own any stock in a S&P 500 index fund, such as VFINX / VFIAX, SWPPX, FXAIX, PREIX, etc? Congratulations, you're a shareholder.
- luckydata 7y agoI would be ok with that.
- Canada 7y agoI'm well aware that the shareholders are very diverse and detached. All the more reason to impose a reasonable damages: $1000 per person. Let the market price that into companies that hold such vast amounts of sensitive data.
- MisterBastahrd 7y agoNeato. I'll still make a profit.
- JohnJamesRambo 7y agoAnd it is a tiny part of our portfolio since index funds contain massive diversity. I’d gladly have the stock go to zero.
- rolltiide 7y agoWhich is precisely why the fine isn't material. Government doesn't want to be the force that creates a monopoly of the remaining two companies. Government also doesn't want a corporation desperate enough to put the government in front of a judge and jury. So the result is kickback and relax. Emphasis on kickback.
- eximius 7y agoWhat? $2/citizen? Somehow I thought I was worth more than that.
- teddyuk 7y agoHow does Facebook get billions and equifax gets millions? Equifax goes out and gathers your personal finance data without even asking, they literally take it whether you want them to or not. Facebook is data people choose to share freely. This just seems like equifax should be settling with an extra zero on the end!
- harryh 7y agoThey do ask. It's one of the conditions in any loan you take out.
- koliber 7y agoThat's like $3 dollars per affected adult!
- solarkraft 7y ago> Most of the roughly $650 million payment would go toward compensating consumers for costs associated with the breach 4,48$ per person. That ought to undo the damage of all your most personal information being public.
- asdff 7y agoWhy do we always fine companies and not the executives involved who made these decisions directly? Fining companies ensures the fines are mitigated and passed to the consumer ultimately, and rarely effect change, but even Zuckerberg would be stammering and sweating if he personally was issued a 5bn fine that he himself had to pay and couldn't have his company absorb.