Equifax Should Pay More: The Case, the Settlement, the Gaps

Few data breaches have shaped public understanding of identity risk like the 2017 Equifax incident. A credit bureau, a company whose business is collecting and selling information about consumers, lost control of that information on a massive scale. About 147 million people were affected, and many of them had never signed up for anything with the company. Years later, the debate over whether Equifax paid enough continues, and it raises broader questions about accountability when the harm is long-lasting and the victims are not customers in the usual sense. This article reviews the case for and against greater penalties, summarizes what the settlement provided and explains what you can do now. Start with our background article, Equifax data breach: millions still at risk.

1. What happened, in brief

In 2017 Equifax announced a cybersecurity incident in which attackers accessed consumer data. The company said that data for approximately 147 million people was involved. Exposed information included names, birth dates and government ID numbers for many people, and addresses, driver’s license numbers and, for smaller groups, payment card details. Regulators later alleged failures in the company’s security practices. For official details, see the materials published by the Federal Trade Commission and the Consumer Financial Protection Bureau.

The reason the incident mattered so much is the kind of information involved. Credit bureaus hold the data used to verify identity and open credit. When that data leaks, victims cannot simply change a password.

2. The 2019 settlement

In 2019, Equifax reached a settlement with the FTC, the CFPB and state attorneys general. The settlement announced by the agencies included a monetary component with funds for consumer relief, payments to states and civil penalties, along with requirements to improve its information security program. Consumers could seek free credit monitoring or, under certain conditions, cash payments for time spent and certain out-of-pocket expenses. Because many more people filed claims than expected, cash payments for those who chose that option were smaller than initially advertised. Check the agencies’ official sites for current information, as terms and claim periods may have ended.

3. The argument that Equifax should pay more

The harm is permanent

Passwords can be changed. A birth date and a government ID number cannot. Exposure created a risk that can last decades, so a payment calibrated to a few years of monitoring underestimates the harm.

Victims were not customers

Most affected people never chose Equifax. Their data was collected as a byproduct of the credit system. Critics argue that a company that profits from consumer data owes a higher duty of care to the people it describes.

The penalty looked small

When divided across 147 million people, even a headline sum yields modest per-person amounts. Compared with the company’s size and the permanence of the harm, critics argue that it falls short of deterrence. We examine the general question in do big fines prevent data leaks.

Monitoring is not remediation

Credit monitoring tells you when something changes. It does not stop fraud. Our article on what happens beyond credit monitoring explains the difference.

Systemic risk

Concentrating sensitive records in a few institutions creates single points of failure. Penalties that do not change that structure leave the risk in place.

Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.

4. The argument for restraint

Defenders of the outcome note that it combined money, binding security requirements and a framework for oversight. They point out that a penalty large enough to bankrupt a credit bureau would not help consumers, and that structural improvements may matter more than a headline number. They also note that penalties are limited by the legal standards regulators must meet. Both views have merit. The practical lesson is that waiting for a perfect remedy is not a plan.

5. What this means for your protection

The most effective response to a breach of permanent data is to change what that data can do. You do that by blocking credit applications, tightening verification and reducing the public information that criminals use to complete a profile.

Place a security freeze at all three bureaus

By federal law, freezes are free. A freeze prevents most lenders from viewing your file for new credit, which stops most new-account fraud. See what a credit freeze is and the FTC’s instructions.

Review your reports

You are entitled to free credit reports. Check them for accounts you do not recognize and dispute errors in writing. The CFPB explains your rights.

Understand how bureaus use your data

Credit reporting agencies share information under legal rules. Our guide on stopping reporting agencies from selling and sharing data shows what you can limit.

Use unique passwords and two-factor authentication

Credentials are the part of your identity you can change. Make them strong.

Watch for tax and benefit fraud

Government ID numbers can be misused for tax and benefit claims. If a return is rejected because one was already filed, report it promptly.

Remove public listings

Fraudsters pair leaked records with current addresses and phone numbers. Take those away through official opt-outs such as Spokeo, PeopleConnect and That’s Them. Our data removal guide walks through the full process.

Report problems

File at IdentityTheft.gov and report scams at ReportFraud.ftc.gov.

6. What the case changed

The Equifax breach prompted lasting changes. Credit freezes became free by federal law in 2018. Public awareness of identity risk grew, and the case became a reference point in debates about data security, breach notification and consumer remedies. It also led many people to realize that their data sits in systems they never chose. State lawmakers, including in California, expanded privacy rights, and agencies built new tools. The California Privacy Protection Agency operates DROP for broker deletion requests, which opened to residents on January 1, 2026.

7. Timeline: acting after a mega-breach

When	Action
Day 1	Freeze credit at all three bureaus
Week 1	Change passwords, enable two-factor authentication
Month 1	Review reports, remove public listings
Yearly	Pull reports, confirm freezes
Long term	Stay alert for tax and benefit fraud

8. What the credit bureau model means for you

Credit bureaus collect data from lenders, utilities and public sources, then sell reports and scores to businesses that make decisions about you. You are not the customer; you are the subject. That is why you cannot simply switch providers after a breach. Understanding this structure explains why consumer protections around freezes, disputes and free reports exist: they are the controls the law gives you over a system you did not choose to join. The Consumer Financial Protection Bureau publishes plain-language guides to using them.

9. Practical questions people still ask

Do I need to freeze every bureau? Yes. Lenders may check any one of them, so a freeze at only one leaves doors open.

Will a freeze stop me from getting a loan? It stops lenders from seeing your file until you lift the freeze. You can lift it temporarily when you apply, and you can do so online or by phone.

Is a fraud alert the same? No. An alert asks businesses to verify your identity before extending credit, but a freeze blocks access outright. Many people use a freeze for long-term protection.

What about children? Parents can ask about freezes for minors and should check for credit files in a child’s name, since fraud on a child’s number can go unnoticed for years.

10. Staying skeptical of claim offers

High-profile settlements attract scams. Fraudsters send fake emails and texts offering payment if you verify your bank login or pay a fee. Real settlements never require you to pay to receive money. When in doubt, go directly to the official agency website by typing the address yourself, and report suspicious messages to ReportFraud.ftc.gov.

11. Three scenarios and what to do

Scenario 1: You learn your data was exposed years ago. Freeze credit now. It is not too late.

Scenario 2: A tax return is rejected. Report identity theft and follow the instructions from the tax agency.

Scenario 3: You receive an email about a settlement. Verify through official agency websites and never pay to claim.

12. Myths and facts

Myth	Fact
The settlement fixed the harm	It provided relief but did not recall data
Credit bureaus only hold data about customers	They hold data on nearly everyone with credit history
A freeze hurts my credit score	It does not affect your score
Monitoring stops fraud	It only alerts
The risk ended in 2017	It continues

13. Common mistakes

Skipping the freeze because the breach was long ago.
Relying on free monitoring.
Ignoring tax and benefit fraud.
Not checking the family’s credit.
Paying fees to claim settlements.

14. Questions to ask yourself

Is my credit frozen at all three bureaus? When did I last read my reports? Would I notice a rejected tax return? Could someone find my current address and relatives? Address the weakest answer first.

15. How Wiperts fits

You cannot make leaked identity numbers disappear, but you can shrink the public details that make them dangerous. Wiperts scans more than 100 data brokers and people-search sites, submits removal requests, removes personal results from Google and Bing, blurs your home on maps and monitors for returning profiles. Start with the free diagnosis.

100% Free Diagnosis: Check Your Exposure

Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:

First Name
Last Name
Select State
Email Address
Website

Scan Databases Now — no payment is needed to see your exposure report.

16. Key takeaways

The 2017 Equifax breach exposed permanent identity data for about 147 million people.
The settlement helped, but critics say it could not match the long-term harm.
A free credit freeze is the key protection.
Remove public listings to reduce what criminals can combine.

Pick the Wiperts plan that fits your household

Plan	Covers	One-time deep scrub	Then
Individual	1 person	$89	$14/month
Couples (most popular)	2 people	$149	$24/month
Family	Up to 4 people	$199	$39/month

Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal

17. Frequently Asked Questions

How many people were affected by the Equifax breach?

About 147 million people were affected by the 2017 breach, according to the figures widely reported and used by regulators.

What data was exposed?

The incident exposed names, birth dates and government ID numbers for many people, plus other details for some, such as addresses and driver’s license numbers.

Was there a settlement?

Yes. In 2019 Equifax reached a settlement with the FTC, the CFPB and states that included funds for consumer relief, credit monitoring and security requirements.

Why do critics say Equifax should pay more?

Critics argue that the harm is long-lasting, that exposed identity data cannot be changed and that individual payouts were small relative to the risk.

Can I still be affected years later?

Yes. Birth dates and government ID numbers do not expire, so protective steps remain important.

What is the best protection today?

A free security freeze at all three bureaus, unique passwords, alerts and removal of public listings that help criminals complete profiles.

Sources

Ready to erase your footprint?

Stop letting data brokers profit from your personal life. Start your removal today.

Start Removing