Equifax To Pay Mass. $18.2 Million In Settlement, AG Healey Announces

Equifax will pay Massachusetts $18.2 million and change its security practices as part of a settlement between the credit reporting agency and the state stemming from a major 2017 data breach, Attorney General Maura Healey announced Friday.

Healey sued Equifax shortly after the company's alleged missteps exposed personal data, including Social Security numbers and driver's license numbers, of 147 million Americans and 3 million Massachusetts residents. The attorney general said the company also failed to notify consumers in a timely manner once the breach occurred.

Her office reached its own settlement with Equifax about nine months after declining to join other states in July 2019 agreements, which the attorney general told reporters allowed Massachusetts to secure a larger payment and more strict conditions on the company.

"This is one of the largest penalties ever paid to a single state over a data breach, but it reflects how seriously we took it and how egregious the conduct was by Equifax," Healey told reporters on a conference call Friday afternoon.

The $18.2 million will mostly go into the general fund for use on any state purpose. Some may also be available for local consumer groups to assist customers.

As part of the settlement, Equifax will also be required to minimize its data collection, maintain up-to-date software, conduct regular security monitoring, and submit for outside review of its practices, Healey said.