Indiana sues Equifax after 2017 data breach

INDIANAPOLIS (WISH) — The state is suing one of the largest financial institutions in the country and hoping thousands of Hoosiers will benefit.

Attorney General Curtis Hill made the announcement Monday. 

Equifax is one of three U.S. credit bureaus. You might remember their massive 2017 data breach affected almost 148 million Americans, about 4 million of those in Indiana. 

Attorney General Hill said his office started its investigation into Equifax as soon as they found out about the breach. 

The credit reporting agency has Social Security numbers, birthdates, addresses and driver’s licenses. Hackers got a hold of that information and much more from mid-May through July 2017. Equifax found out about the breach at the end of July 2017, and told consumers in September 2017. 

Hill maintains this breach never would have happened if Equifax followed basic procedures, laws and their own standards. In 2015, he said, Equifax was made aware of thousands of internal and external vulnerabilities, but did not follow their own policies about getting them fixed in a timely manner. In one of their programs, passwords were short and easy to guess.

Indiana joins Massachusetts and West Virginia as states suing the financial company. 

“We want to take a look at what we can do to get value back to the 4 million Hoosiers that are exposed, so most of this will be dealt with through litigation,” Hill said. “Also, there’s a factor in there for making sure that companies that should be better learn that they need to do better.”

Hill said they want to be friendly with businesses but did not feel Equifax acted in the best interests of Hoosiers after the breach. Part of what the state is seeking is payback for people who were part of the breach and may have spent money to try to prevent issues with their credit or personal information.

An Equifax security website offers help for people who may have been affected.