Case Name: In re Equifax Inc. Customer Data Security Breach Litigation
Case Number: 1:17-md-02800
Court: U.S. District Court for the Northern District of Georgia
Role: Co-Lead Counsel
Outcome: $1.5B Settlement

In re Equifax Inc. Customer Data Security Breach Litigation

Equifax Data Breach Class Action

DiCello Levitt achieved a record $1.5 billion settlement for consumers harmed by one of the largest data breaches in U.S. history.

“[T]he largest and most comprehensive recovery in a data breach case in U.S. history by several orders of magnitude.”
—U.S. District Court Judge Thomas W. Thrash Jr.

When credit reporting giant Equifax failed to safeguard its systems, it triggered one of the most catastrophic data breaches ever recorded. More than 147 million people had their personal and financial data compromised—including Social Security numbers, birth dates, addresses, and even driver’s license and credit card numbers. In July 2019, together with Co-Lead Counsel, DiCello Levitt secured a landmark settlement valued at more than $1.5 billion in the multidistrict litigation pending in the U.S. District Court for the Northern District of Georgia. The settlement included up to $505.5 million in cash relief and required Equifax to spend at least $1 billion over five years to overhaul its data security practices.

Key Court Decisions

On January 28, 2019, the plaintiffs defeated Equifax’s motion to dismiss, with U.S. District Court Judge Thomas W. Thrash Jr. ruling that Equifax owed a duty of care to safeguard the personal and financial information in its custody. The court observed that holding otherwise would create a perverse incentive for businesses profiting from consumers’ personal data to ignore known cybersecurity risks.
On January 13, 2020, Judge Thrash granted final approval of the landmark $1.5 billion settlement resolving the nationwide data breach litigation. The settlement provided substantial monetary and injunctive relief for consumers and required Equifax to invest at least $1 billion to upgrade its data security and technology infrastructure.

Case Overview

In September 2017, Equifax announced a massive cybersecurity failure that exposed highly sensitive data on nearly half the U.S. population. Hackers accessed personal and financial records, leaving consumers vulnerable to identity theft and financial fraud. Hundreds of lawsuits followed, demanding accountability and justice.

The scope of the breach was staggering: More than 147 million Americans had their private data compromised. For many consumers, the fallout included years of vigilance against identity theft, the burden of credit monitoring, and countless hours spent restoring their financial security.

DiCello Levitt played a central role in holding Equifax accountable and securing lasting protections for millions of Americans. Amy Keller, chair of DiCello Levitt’s Privacy, Technology, and Cybersecurity Litigation Practice Group, was appointed Consumer Plaintiffs’ Co-Lead Counsel in the nationwide multidistrict litigation.

In July 2019, the parties announced a historic settlement valued at more than $1.5 billion. The settlement included a consumer restitution fund to provide benefits to consumers impacted by the breach, including reimbursement for up to $20,000 in out-of-pocket losses, compensation for time spent dealing with issues related to the breach, credit monitoring services, and identity restoration assistance. The settlement also required Equifax to overhaul its business practices and spend at least $1 billion on incremental security upgrades over five years. The value of the credit monitoring services available to consumers alone was estimated to exceed $282 billion at retail cost.

The litigation arose from allegations that Equifax failed to adequately protect some of consumers’ most sensitive personal and financial information despite known cybersecurity risks. The breach sparked nationwide scrutiny from consumers, regulators, legislators, and courts, and intensified public discussion around data privacy and corporate cybersecurity responsibilities.

This case is In re Equifax Inc. Customer Data Security Breach Litigation, No. 1:17-md-02800, in the U.S. District Court for the Northern District of Georgia. The DiCello Levitt team was led by Amy Keller and included Adam J. Levitt, Mark M. Abramowitz, and Justin J. Hawal.