In March of 2017, the Department of Homeland Security alerted Equifax to a critical software vulnerability in its online consumer dispute portal. Unfortunately, a combination of human error at Equifax and the company's ineffective scanning software apparently conspired to leave the unpatched hole open. That site was vulnerable to a data breach, and hackers managed to obtain personal financial details about nearly half the U.S. population.
Worse yet, Equifax was slow to report the breach to consumers and, once it did, it mistakenly directed them to a fake website that further compromised their data. The breach had cost Equifax nearly $243 million as of the first quarter of 2018.
It's bad enough when one of the nation's largest consumer credit rating companies exposes Social Security numbers, driver's license numbers and other personal information to hackers. Unscrupulous people can use such information, for example, to open fraudulent credit card accounts and charge away in the victim's name.
Even if the victim is able to have all the false charges rescinded, the recommended credit freeze can unfairly lower their credit rating. That not only makes borrowing more expensive, but it can also affect everything from housing availability to eligibility for certain government grants.
Naturally, large legal battles are underway in an attempt to hold Equifax liable for the breach. Notably, 400 separate lawsuits by individuals and businesses have been consolidated into a single federal class action in Atlanta, where Equifax is headquartered. Unfortunately, such lawsuits can take years to resolve.
A number of private citizens have taken another route. They have been suing the credit rating giant in their local small claims courts -- and they have been winning.
Preparation and careful documentation of harm are necessary to prevail
One plaintiff recently profiled by the New York Times won $7,440. Another received $5,490. A third only got $690. Some were awarded the cost of a credit monitoring service, while others received money for the time they spent dealing with the breach, and even compensation for emotional distress.
According to the Times, people who have prevailed against Equifax in small claims court say the keys to their success are careful preparation of their arguments and thorough documentation of the harm they have experienced.
"Take screenshots of internet pages; if you get weird phone calls, keep your phone records," said one successful plaintiff.
The upside of small claims court is that it is fast. However, the allowable case size is limited (in Pennsylvania, your claim must be for less than $12,000). Still, winning plaintiffs get some assistance, some vindication and the sense of having held a giant corporation to account for its misdeeds.