A settlement has been reached in the Equifax data breach lawsuit, of which CUNA, Leagues and credit unions are plaintiffs. CUNA filed suit against Equifax in October 2017 after a data breach that exposed the personal information of more than 145 million consumers and 209,000 credit card numbers.  

CUNA, along with certain other institutional plaintiffs, were recently allowed back as plaintiffs to join the institutions that issued compromised cards as plaintiffs.  

The Settlement Class will be limited to financial institutions that had alerted-on payment cards as a result of the breach. Class members will be permitted to make claims for losses attributable to the alerted-on payment cards as well as damages they suffered resulting from their customers’ personally identifiable information (PII) exposure. 

“Credit unions have borne substantial costs as a result of this massive data breach, and the settlement offers recourse on the path toward making affected credit unions whole again,” said CUNA President/CEO Jim Nussle. “Breaches like this are occurring on a regular basis, and the only thing that will prevent them in the future is a strong national data security standard that holds all entities accountable. CUNA and the Leagues look forward to continuing our engagement with Congress to enact robust data security requirements for all who handle consumers’ personal information.” 

The settlement provides up to $4.50 per alerted-on payment card as well as up to $5,000 per financial institution for its documented damages claim resulting from PII theft for class members. The total amount being offered for these two components is $5.5 million.  

Equifax has also agreed to spend $25 million to enhance its data security measures and compliance with the Payment Card Industry Data Security Standard (PCI-DSS).