8 ms·

FTC: Equifax might run out of cash, so please take the credit monitoring

79 points by fooey 7y ago

not_a_cop75 7y ago
"The FTC said Wednesday that consumers rushing to get a $125 check from Equifax as restitution for its 2017 cybersecurity breach should consider the credit monitoring option because the company could run out of money before satisfying all the claims." As someone that constantly watches credit brokers abuse a broken system, I'm okay with this. Let their CEOs get their parachute pay. while their reputations are publicly and privately castrated. Honestly, as consumers, we can go after that too, if we really want.
simonsarris 7y ago
The most insane thing is that they are asking you to take the bet that Equifax and companies like them will screw this up again by calling it a better deal.
wpskidd 7y ago
Dear FTC, Duly noted that poor planing may lead to the exhaustion of the paltry reserves Equifax set up for the actual victims of its crimes. How about some real justice then?
Simulacra 7y ago
Equifax running out of cash? GOOD! Bankrupt the jerks.
calvinbhai 7y ago
This settlement itself is a scam. It looks like a cunningly smart settlement announcement. Offer something that looks like a worthy settlement, drive millions of people to get the cash option, then claim that too many are going for the cash option, so they'll all get peanuts now (if 10 million chose cash option and only 31 million is available, then it's $3 per head?). That's a cheap way to get rid of any liability in the future. Facebook didn't get hacked, and was fined $5 billion (do affected facebook users get anything from that amount? not sure) Equifax leaked extremely important details of persons, and was fined peanuts. How does this make sense?
fooey 7y ago
The FTC's FAQ that was updated: https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq... > 5. I thought I could choose $125 instead of free credit monitoring. What happened? > The public response to the settlement has been overwhelming. Millions of people have visited this site in just the first week. Because the total amount available for these alternative payments is $31 million, each person who takes the money option is going to get a very small amount. Nowhere near the $125 they could have gotten if there hadn’t been such an enormous number of claims filed. > The free credit monitoring provides a much better value, and everyone whose information was exposed can take advantage of it. If your information was exposed in the data breach, and you file a valid claim before the deadline, you are guaranteed at least four years of free monitoring at all three credit bureaus (Equifax, Experian, and TransUnion) and $1,000,000 of identity theft insurance, among other benefits. The market value of this product is hundreds of dollars per year. > You can still choose the cash option on the claim form, but you will be disappointed with the amount you receive and you won’t get the free credit monitoring. For a little math, $31 million only makes it to 248,000 claims of the 150,000,000 people affected before it starts diluting.
- taborj 7y ago
  > For a little math, $31 million only makes it to 248,000 claims of the 150,000,000 people affected before it starts diluting. It's even more fun if you look at it as a percentage. They leaked data on 147,000,000 people, and only have enough cash to pay out for 248,000. That's 0.0017% of those affected. Who in their right mind thought that so few would want reimbursement?
- kingnothing 7y ago
  If 150M people have suffered $125 in damages each, then Equifax needs to either pay out the $18B or declare insolvency.
  - zadkey 7y ago
    I agree. This is the best solution. This is what Equifax deserves. Though honestly, it's not enough. How much damage can someone do with my name and social security number? I bet you it's more than 125 dollars can fix. This data could end up circulating the web or dark web for years and years.
pssflops 7y ago
I trust Equifax even less to monitor my credit safely than to pay out the money they owe to consumers for their years of deception in business practices.
joshstrange 7y ago
So this is some bullshit, if FB can get hit with a $5 Billion dollar fine then I think we can scape up a little more than $31 Million from a company with even less scruples than Facebook... Also I already signed up for the $125 (when there was ZERO mention it might not be paid out) so what am I supposed to do? God I really wish they had just put down Equifax (as in killed the whole company) as a statement to other companies: PROTECT YOUR DATA or we are coming for you. And NO I don't want their monitoring, if they couldn't keep my info safe to start with why would I trust them with monitoring.
- fooey 7y ago
  The settlement should have required them to provide free credit monitoring to every US citizen in perpetuity, AND a cash payout to all the people they screwed over.
- daybreak 7y ago
  > Also I already signed up for the $125 (when there was ZERO mention it might not be paid out) so what am I supposed to do? From the FAQ, they'll send out an email to everyone who already filed allowing people to switch to credit monitoring. I agree, this is ridiculous. Even credit monitoring for life (from the other agencies) would have been better than this.
mywittyname 7y ago
We need The Corporate Death Penalty and we need to be able to enforce it in such a way that intangible assets can't be copied over to another entity which is left to continue operations. Hard assets can be auctioned and used to pay unemployment claims and restitution. Jail time for senior leadership would be nice too.
- digitalsushi 7y ago
  How can we get a politician to vote for a corporate death penalty when faced with tens, or hundreds, of thousands of now jobless constituents after its first sentencing is upheld?
  - tareqak 7y ago
    Pay out several months of severance to each innocent employee.
    - anticensor 7y ago
      First nationalise the legal entity so that the board cannot block the actions. Maybe pay a fair share of paid-for capital to employees, proportional to their pays they earned for the last full payment period, as a severance (this might result in lower-than-minimum severance, but better than nothing that you would get in a regular bankruptcy). However, shareholders which would get more dividends than this payout should only be allowed to be paid up to a week of minimum wage in this severance payout, to avoid exit bonuses. Assets should be auctioned off in a quick increment auction, to pay for debts to outsiders, and IP rights to be available to public domain immediately before severance payout starts. If any surplus money remains in the final account, it should be transferred to the legislative to be used for anti-corruption investigations. The legal entity can be vanished after all these finishes.
      - mrguyorama 7y ago
        Why should shareholders get a dime? They backed a shitty company, they should also feel that pain. If they don't want to get hurt like that, they should utilize their rights to keep dangerous and toxic people out of executive level positions
situational87 7y ago
$31 million is a laughably small amount of money to set aside for direct settlements in the biggest hack in all of history. Add three zeroes to that, probably still not enough. I spent three days figuring out this nightmarish credit reporting system and helping friends and family place freezes, as well as educating them to avoid all the horrible dark patterns on Equifax's site. What I want is about $2000 and the ability to opt out of them owning and reselling my personal data completely. I don't need credit monitoring, I don't need credit period anymore, why am I forced into accepting the unlimited risk of them owning all my data so that this private company can keep operating?
- mason55 7y ago
  As part of the settlement you can charge for your hourly time that you had to spend figuring out credit monitoring
  - mooman219 7y ago
    Comes out of the same $31 million. I'm unsure how distribution will work once more than $31 million is requested, but you're likely not going to see the full amount.
    - paulgb 7y ago
      My reading of the settlement is that of the $310 million, up to $31 million (10%) is allocated to hourly time claims (section 6.2.6) and a separate $31 million is allocated to "Alternative Reimbursement Compensation", i.e. the $125 cheques (section 7.5). So it's still capped at the same amount, but comes from a different pool.
      - taborj 7y ago
        Either way, it's still a laughably small amount to set aside. They leaked data on 147 million people, are they really only expecting 248k people to want to be reimbursed? That's 0.0017% of the affected population.
kayfox 7y ago
I'm going to go for the check, because its something I can frame.
jpetrucc 7y ago
It seems absurd that they only need to allocate $31 million for "alternative payments" while the old CEO leaves with close to $20 million in bonuses [0], while the rest of the money in the settlement is basically reserved for them to pay themselves for their "free" credit monitoring. This whole situation was a good opportunity to set a precedent for companies not taking data security seriously. But they've instead shown everyone that you can really just ignore all of that and hope it's never discovered - even if it is, it's really just a light slap on the wrist. Combining this with the recent Facebook fine [1], it really makes me think that the FTC has become a complete joke. [0]: https://www.cbsnews.com/news/equifax-data-breach-settlement-disgraced-former-ceo-getting-nearly-20-million-in-bonuses-after-the-hack/ https://www.cbsnews.com/news/equifax-data-breach-settlement-... [1]: https://www.theverge.com/2019/7/12/20692524/facebook-five-billion-ftc-fine-embarrassing-joke https://www.theverge.com/2019/7/12/20692524/facebook-five-bi...
- basch 7y ago
  What I want to know is how they established part of the settlement for damages caused by the breach, yet there is 0 evidence that any of the data has ever become public. How would someone prove they were affected, if nobody was affected?
- jiveturkey 7y ago
  As I've noted before, PII is not, in fact, toxic.
- triangleman 7y ago
  You had me until you mentioned the Facebook fine. $5 billion, assuming it stands, is a lot of money and a good deterrent against the kind of behavior FB was engaged in. No shareholder would be happy that their company lost that much money. And before someone retorts with the fact that the stock went up the day the fine was announced: shareholders could be happy that the uncertainty is over, but still not happy with the fine.
  - bradknowles 7y ago
    Nah. They’ll make that back in a few minutes. If you’re not talking about a sizable portion of their gross annual revenue or their total market capital, you’re going to have little or no effect on any corporation. If you really want to have an effect on a corporation, the only way to do that is to pierce the corporate veil, and hold the senior executives and the board members personally liable. That will get them to change big time, and in a hurry. When you endanger the mega yachts and the private islands, you’ll get them to sit up and take notice.
post_break 7y ago
Nothing like being forced to use a company, who leaks your very important information, who gets set a tiny amount of money to pay out for damages, only to be told not to take it because that money might not be enough to pay everyone who was affected.
gorbachev 7y ago
I'm sure I'm not the only one actually wishing they run out of money. I'd be happy to put them on a payment plan.
- Operyl 7y ago
  It won’t work like that, though. It’ll just mean that the 125 the vast majority of people expected will probably end up at 25 bucks each, depending on how many people requested the cash payout.
  - bdcravens 7y ago
    If everyone eligible claims the $125, it's more like $0.25. Many won't, but everyone will be lucky to receive enough for a cup of coffee. It's all a sham. And they are still compiling all of our information so make the next breach even better.
btreecat 7y ago
LOL no
nathanaldensr 7y ago
Supposedly the settlement encourages me to trust Equifax to monitor my tradelines through "free credit monitoring"... but I can't trust the same company to monitor the safety of that very same data. Yeah, this makes a lot of sense...
deleted 7y ago
[deleted]
urda 7y ago
Yeah no Equifax can pay out, they don't need any additional protections for their mistakes.
hobs 7y ago
"You might also be disappointed to learn that if you sign up for Equifax credit monitoring, they sell your data + require binding arbitration https://www.equifax.com/assets/corp/consumer-privacy-notice.pdf https://www.equifax.com/assets/corp/consumer-privacy-notice.... https://pbs.twimg.com/media/EA1KK-vUwAAmrnd.jpg"[0] https://pbs.twimg.com/media/EA1KK-vUwAAmrnd.jpg"[0] [0]https://twitter.com/hoofnagle/status/1156662788221050881 https://twitter.com/hoofnagle/status/1156662788221050881
- Fej 7y ago
  So taking the "free" credit monitoring is a net negative?
dreamcompiler 7y ago
Credit Karma will already monitor your credit for free. Letting Equifax do it just lets them off the hook.

79 points by fooey 7y ago

"The FTC said Wednesday that consumers rushing to get a $125 check from Equifax as restitution for its 2017 cybersecurity breach should consider the credit monitoring option because the company could run out of money before satisfying all the claims." As someone that constantly watches credit brokers abuse a broken system, I'm okay with this. Let their CEOs get their parachute pay. while their reputations are publicly and privately castrated. Honestly, as consumers, we can go after that too, if we really want.

simonsarris 7y ago

The most insane thing is that they are asking you to take the bet that Equifax and companies like them will screw this up again by calling it a better deal.

wpskidd 7y ago

Dear FTC, Duly noted that poor planing may lead to the exhaustion of the paltry reserves Equifax set up for the actual victims of its crimes. How about some real justice then?

Simulacra 7y ago

Equifax running out of cash? GOOD! Bankrupt the jerks.

calvinbhai 7y ago

This settlement itself is a scam. It looks like a cunningly smart settlement announcement. Offer something that looks like a worthy settlement, drive millions of people to get the cash option, then claim that too many are going for the cash option, so they'll all get peanuts now (if 10 million chose cash option and only 31 million is available, then it's $3 per head?). That's a cheap way to get rid of any liability in the future. Facebook didn't get hacked, and was fined $5 billion (do affected facebook users get anything from that amount? not sure) Equifax leaked extremely important details of persons, and was fined peanuts. How does this make sense?

fooey 7y ago

The FTC's FAQ that was updated: https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq... > 5. I thought I could choose $125 instead of free credit monitoring. What happened? > The public response to the settlement has been overwhelming. Millions of people have visited this site in just the first week. Because the total amount available for these alternative payments is $31 million, each person who takes the money option is going to get a very small amount. Nowhere near the $125 they could have gotten if there hadn’t been such an enormous number of claims filed. > The free credit monitoring provides a much better value, and everyone whose information was exposed can take advantage of it. If your information was exposed in the data breach, and you file a valid claim before the deadline, you are guaranteed at least four years of free monitoring at all three credit bureaus (Equifax, Experian, and TransUnion) and $1,000,000 of identity theft insurance, among other benefits. The market value of this product is hundreds of dollars per year. > You can still choose the cash option on the claim form, but you will be disappointed with the amount you receive and you won’t get the free credit monitoring. For a little math, $31 million only makes it to 248,000 claims of the 150,000,000 people affected before it starts diluting.

taborj 7y ago
> For a little math, $31 million only makes it to 248,000 claims of the 150,000,000 people affected before it starts diluting. It's even more fun if you look at it as a percentage. They leaked data on 147,000,000 people, and only have enough cash to pay out for 248,000. That's 0.0017% of those affected. Who in their right mind thought that so few would want reimbursement?
kingnothing 7y ago
If 150M people have suffered $125 in damages each, then Equifax needs to either pay out the $18B or declare insolvency.
- zadkey 7y ago
  I agree. This is the best solution. This is what Equifax deserves. Though honestly, it's not enough. How much damage can someone do with my name and social security number? I bet you it's more than 125 dollars can fix. This data could end up circulating the web or dark web for years and years.

pssflops 7y ago

I trust Equifax even less to monitor my credit safely than to pay out the money they owe to consumers for their years of deception in business practices.

joshstrange 7y ago

So this is some bullshit, if FB can get hit with a $5 Billion dollar fine then I think we can scape up a little more than $31 Million from a company with even less scruples than Facebook... Also I already signed up for the $125 (when there was ZERO mention it might not be paid out) so what am I supposed to do? God I really wish they had just put down Equifax (as in killed the whole company) as a statement to other companies: PROTECT YOUR DATA or we are coming for you. And NO I don't want their monitoring, if they couldn't keep my info safe to start with why would I trust them with monitoring.

fooey 7y ago
The settlement should have required them to provide free credit monitoring to every US citizen in perpetuity, AND a cash payout to all the people they screwed over.
daybreak 7y ago
> Also I already signed up for the $125 (when there was ZERO mention it might not be paid out) so what am I supposed to do? From the FAQ, they'll send out an email to everyone who already filed allowing people to switch to credit monitoring. I agree, this is ridiculous. Even credit monitoring for life (from the other agencies) would have been better than this.

mywittyname 7y ago

We need The Corporate Death Penalty and we need to be able to enforce it in such a way that intangible assets can't be copied over to another entity which is left to continue operations. Hard assets can be auctioned and used to pay unemployment claims and restitution. Jail time for senior leadership would be nice too.

digitalsushi 7y ago
How can we get a politician to vote for a corporate death penalty when faced with tens, or hundreds, of thousands of now jobless constituents after its first sentencing is upheld?
- tareqak 7y ago
  Pay out several months of severance to each innocent employee.
  - anticensor 7y ago
    First nationalise the legal entity so that the board cannot block the actions. Maybe pay a fair share of paid-for capital to employees, proportional to their pays they earned for the last full payment period, as a severance (this might result in lower-than-minimum severance, but better than nothing that you would get in a regular bankruptcy). However, shareholders which would get more dividends than this payout should only be allowed to be paid up to a week of minimum wage in this severance payout, to avoid exit bonuses. Assets should be auctioned off in a quick increment auction, to pay for debts to outsiders, and IP rights to be available to public domain immediately before severance payout starts. If any surplus money remains in the final account, it should be transferred to the legislative to be used for anti-corruption investigations. The legal entity can be vanished after all these finishes.
    - mrguyorama 7y ago
      Why should shareholders get a dime? They backed a shitty company, they should also feel that pain. If they don't want to get hurt like that, they should utilize their rights to keep dangerous and toxic people out of executive level positions

situational87 7y ago

$31 million is a laughably small amount of money to set aside for direct settlements in the biggest hack in all of history. Add three zeroes to that, probably still not enough. I spent three days figuring out this nightmarish credit reporting system and helping friends and family place freezes, as well as educating them to avoid all the horrible dark patterns on Equifax's site. What I want is about $2000 and the ability to opt out of them owning and reselling my personal data completely. I don't need credit monitoring, I don't need credit period anymore, why am I forced into accepting the unlimited risk of them owning all my data so that this private company can keep operating?

mason55 7y ago
As part of the settlement you can charge for your hourly time that you had to spend figuring out credit monitoring
- mooman219 7y ago
  Comes out of the same $31 million. I'm unsure how distribution will work once more than $31 million is requested, but you're likely not going to see the full amount.
  - paulgb 7y ago
    My reading of the settlement is that of the $310 million, up to $31 million (10%) is allocated to hourly time claims (section 6.2.6) and a separate $31 million is allocated to "Alternative Reimbursement Compensation", i.e. the $125 cheques (section 7.5). So it's still capped at the same amount, but comes from a different pool.
    - taborj 7y ago
      Either way, it's still a laughably small amount to set aside. They leaked data on 147 million people, are they really only expecting 248k people to want to be reimbursed? That's 0.0017% of the affected population.

kayfox 7y ago

I'm going to go for the check, because its something I can frame.

jpetrucc 7y ago

It seems absurd that they only need to allocate $31 million for "alternative payments" while the old CEO leaves with close to $20 million in bonuses [0], while the rest of the money in the settlement is basically reserved for them to pay themselves for their "free" credit monitoring. This whole situation was a good opportunity to set a precedent for companies not taking data security seriously. But they've instead shown everyone that you can really just ignore all of that and hope it's never discovered - even if it is, it's really just a light slap on the wrist. Combining this with the recent Facebook fine [1], it really makes me think that the FTC has become a complete joke. [0]: https://www.cbsnews.com/news/equifax-data-breach-settlement-disgraced-former-ceo-getting-nearly-20-million-in-bonuses-after-the-hack/ https://www.cbsnews.com/news/equifax-data-breach-settlement-... [1]: https://www.theverge.com/2019/7/12/20692524/facebook-five-billion-ftc-fine-embarrassing-joke https://www.theverge.com/2019/7/12/20692524/facebook-five-bi...

basch 7y ago
What I want to know is how they established part of the settlement for damages caused by the breach, yet there is 0 evidence that any of the data has ever become public. How would someone prove they were affected, if nobody was affected?
jiveturkey 7y ago
As I've noted before, PII is not, in fact, toxic.
triangleman 7y ago
You had me until you mentioned the Facebook fine. $5 billion, assuming it stands, is a lot of money and a good deterrent against the kind of behavior FB was engaged in. No shareholder would be happy that their company lost that much money. And before someone retorts with the fact that the stock went up the day the fine was announced: shareholders could be happy that the uncertainty is over, but still not happy with the fine.
- bradknowles 7y ago
  Nah. They’ll make that back in a few minutes. If you’re not talking about a sizable portion of their gross annual revenue or their total market capital, you’re going to have little or no effect on any corporation. If you really want to have an effect on a corporation, the only way to do that is to pierce the corporate veil, and hold the senior executives and the board members personally liable. That will get them to change big time, and in a hurry. When you endanger the mega yachts and the private islands, you’ll get them to sit up and take notice.

post_break 7y ago

Nothing like being forced to use a company, who leaks your very important information, who gets set a tiny amount of money to pay out for damages, only to be told not to take it because that money might not be enough to pay everyone who was affected.

gorbachev 7y ago

I'm sure I'm not the only one actually wishing they run out of money. I'd be happy to put them on a payment plan.

Operyl 7y ago
It won’t work like that, though. It’ll just mean that the 125 the vast majority of people expected will probably end up at 25 bucks each, depending on how many people requested the cash payout.
- bdcravens 7y ago
  If everyone eligible claims the $125, it's more like $0.25. Many won't, but everyone will be lucky to receive enough for a cup of coffee. It's all a sham. And they are still compiling all of our information so make the next breach even better.

btreecat 7y ago

LOL no

nathanaldensr 7y ago

Supposedly the settlement encourages me to trust Equifax to monitor my tradelines through "free credit monitoring"... but I can't trust the same company to monitor the safety of that very same data. Yeah, this makes a lot of sense...

deleted 7y ago

[deleted]

urda 7y ago

Yeah no Equifax can pay out, they don't need any additional protections for their mistakes.

hobs 7y ago

"You might also be disappointed to learn that if you sign up for Equifax credit monitoring, they sell your data + require binding arbitration https://www.equifax.com/assets/corp/consumer-privacy-notice.pdf https://www.equifax.com/assets/corp/consumer-privacy-notice.... https://pbs.twimg.com/media/EA1KK-vUwAAmrnd.jpg"[0] https://pbs.twimg.com/media/EA1KK-vUwAAmrnd.jpg"[0] [0]https://twitter.com/hoofnagle/status/1156662788221050881 https://twitter.com/hoofnagle/status/1156662788221050881

Fej 7y ago
So taking the "free" credit monitoring is a net negative?

dreamcompiler 7y ago

Credit Karma will already monitor your credit for free. Letting Equifax do it just lets them off the hook.