Equifax’s Hacking Nightmare Gets Even Worse For Victims
After Equifax Inc. revealed that sensitive data on two of every five Americans was exposed in a cyberattack, thousands logged onto a company website to see if they were at risk. For many, the site didn’t work at first. But for those who got through, a nasty surprise was waiting.
If your data had been stolen, Equifax offered a free year of credit monitoring known as “TrustedID Premier.” But some fine print may also mean that consumers who agree would be giving up the right to sue over many types of damages related to the massive penetration.
The unprecedented breach, which occurred in July but was disclosed on Thursday, is among the largest in U.S. history, affecting 143 million people. The hack revealed personal information such as Social Security numbers, addresses, driver’s license data, and birth dates, putting millions at risk for identity theft. A proposed multibillion-dollar class action lawsuit was filed Thursday evening. All told, Equifax could be facing as much as $70 billion in claims, said Ben Meiselas, an attorney for Geragos & Geragos, one of the firms that filed the lawsuit.
For already panicked consumers, that fine print—an arbitration clause—has caused further frustration, prompting federal lawmakers and at least one state attorney general to condemn Equifax for appearing to force aggrieved consumers to give up their day in court. Social media was flooded with messages of concern, with some fearing that simply using an Equifax website to check whether their information was compromised bound them to arbitration—a private proceeding which consumer advocates and lawyers consider inherently biased in favor of companies.
“We are witnessing uncharted depths of corporate duplicity, as Equifax is now targeting its victims” by using “stealth arbitration agreements,” Meisalas said. Hopefully this “conduct will finally spur Congress to protect victims of identity theft by stopping corporations from using poison pill arbitration clauses to deprive victims of their day in court.”
On Friday, New York Attorney General Eric Schneiderman asked the company to remove the clause as he opened an investigation.
The National Consumer Law Center describes arbitration as “biased, secretive, and lawless,” in part because arbitrators are blocked from seeing the full extent of a company’s alleged wrongdoing. In a court proceeding, plaintiffs who overcome a motion to dismiss can demand pre-trial evidence from a defendant company, including internal files and witness depositions.
A 2015 study by the U.S. Consumer Financial Protection Bureau, the federal agency created in the wake of the financial crisis, found that more than 75 percent of consumers weren’t even aware they were subject to arbitration clauses. Fewer than 7 percent knew that the clauses restricted their ability to sue, the consumer bureau said.
The only exception are claims against the company in which consumers assert damages under the Fair Credit Reporting Act.
Francis, the plaintiffs’ attorney, said that the circumstances of the latest breach would probably make it difficult for Equifax to prevail in forcing aggrieved consumers into arbitration. But Imre Szalai, a professor at Loyola College of Law in New Orleans who has studied arbitration for 15 years, said the success of such efforts often depends on the personal leanings of judges who initially handle lawsuits filed by consumers. They will decide whether to send them back to Equifax, and arbitration.
Has your identity been stolen? What are you doing to protect your data? Send your stories and thoughts to firstname.lastname@example.org