After three years of a legal battle over one of the worst personal and credit card data breach in US history, Equifax is to now pay a total of $700 million in the data breach settlement which took place in 2017.
According to the report by Associated Press (AP) Equifax will pay up to $700 million to settle with the Federal Trade Commission and others over a 2017 data breach that exposed Social Security numbers and other private information of nearly 150 million people.
The report also stated that the proposed settlement with the Consumer Financial Protection Bureau, if approved by the federal district court Northern District of Georgia, will provide up to $425 million in monetary relief to consumers, a $100 million civil money penalty, and other relief. The bureau coordinated its investigation with the Federal Trade Commission and attorneys general from across the U.S.
The announcement Monday confirms a report by The Wall Street Journal that the credit reporting agency had reached a deal with the U.S.
The judgement is coming almost three years when the news broke that one of US major credit Bureaus has exposed personal and credit data of his over 150million members and some of the members thereafter sued the company on what is known as one of the worst data breaches in US history, if not in the world.
At the break of the news in 2017, that took both Federal and State investigators to investigate, these were some of the weaknesses highlighted which sources believed led to the data breach by hackers:
The first was that a digital certificate that used to authenticate computer servers and systems had been expired for roughly 10 months. As a result, encrypted digital traffic passed through an Equifax system without being detected,
Also, Equifax officials notified the company’s system administration about the program vulnerability that required patching. However, the recipient list was outdated and the notice wasn’t received by the administration who would have installed the patch,
Individual Equifax database was not isolated from each other. As a result, the cyber thieves were able to move from one to others, gathering more and more data without being detected.
The attackers gained access to a database that contained unencrypted usernames and passwords for gaining access to other databases,
Equifax systems lacked restrictions on the number of allowable database queries. As a result, the attackers were able to execute roughly 9,000 queries., far more than what would be needed for normal business operations.