Chicago Sues Equifax Over Massive Data Breach

CHICAGO, IL — The city is suing the credit reporting company Equifax over a data breach that exposed personal information of about 143 million Americans, including more than 5 million people in Illinois. In an announcement Thursday, Mayor Rahm Emanuel said Equifax needs to be held accountable for the breach and its failure to give adequate notice those affected.

“Chicago residents have been unnecessarily exposed to financial risks due to Equifax’s irresponsible and reckless actions that prioritized profit over the privacy and safety of consumer data,” said the mayor.

“We are taking action to hold this company accountable and to protect the residents of Chicago.”

This comes after San Francisco announced a lawsuit Tuesday against Equifax, on behalf of California's 15 million residents who were affected by the breach. While dozens of lawsuits have been filed across the country by states, consumers, shareholders, and credit unions, San Francisco was the first city to launch its suit against the Atlanta-based company. (For more local news, subscribe to free email news alerts and a daily newsletter for your hometown Patch.)

Equifax disclosed earlier this month that a software flaw allowed hackers to access people's personal data, leaving millions vulnerable to identity theft. Hackers were able to access the data from early March through late July.

"Although patches, workarounds, and other fixes for the related vulnerability were available and known to Equifax, it failed to avail itself of these remedies, or to employ other security controls, such as encryption of data or multiple layers of security, that would help to protect consumers’ personal data," The City of Chicago said in a press release.

People's names, addresses, Social Security numbers, birth dates, and other information were compromised in the cyberattack, along with more than 209,000 credit card numbers. Equifax discovered the attack July 29, but waited until Sept. 7 to disclose the hack to the public.

“This is a breach of epic proportions and Equifax should be prosecuted to the full extent of the law. Chicago citizens rely on city government to protect them,” said Chairman Edward M. Burke.

Chicago’s lawsuit claims that Equifax violated the Illinois Personal Information Privacy Act, the Illinois Consumer Fraud and Deceptive Business Practices Act, and the Chicago Consumer Fraud ordinance by exposing people's personal information and failing to provide immediate notice of the breach.

In its press release, the City of Chicago said Equifax misled concerned consumers by initially offering “complimentary identity theft protection and credit file monitoring” while requiring a waiver from future legal action.

Chicago’s lawsuit seeks restitution for Chicago residents. The penalty for violating Chicago’s consumer fraud ordinance includes a fine of between $2,000 and $10,000 for each offense, for each day that the violation continues.

Photo via City of Chicago