Restitution payouts are going out over the holidays from a 2017 data breach that affected around half of the entire United States population, but the money wasn’t quite what was originally offered.
The exposed information included names, Social Security numbers, birthdays, driver’s license numbers, and 200,000 credit card numbers.
Since the breach, a website enabled any American to check if they were hit in the hack.
Supervised by JND Legal Administration — a team of court-appointed lawyers — Equifax made a $700 million settlement, offering affected Americans either a $125 payout or 10 years of free credit monitoring and $1 million in identity theft insurance provided by Equifax. The deadline passed in January 2020 to file a claim for either, according to the settlement website.
Emails sent at the beginning of October 2022 hinted the money would be coming soon, as JND offered to send breach payments to a Paypal account rather than by mailed check. Equifax confirmed payouts started going out Dec. 19, but consumers reported online they were drastically smaller than what was expected.
Lawyer Whitney Merrill shared a screenshot of her payment — just $5.21 instead of $125 — hitting her Paypal account on Twitter.
“The breach of my most sensitive data (most of which I never authorized Equifax to collect and store in the first place) was worth $5.21,” Merrill wrote. “That sure makes up for it.”
Many other users, including one who got a paper check, also reported getting $5.21, but a select number of people claimed they received differing amounts. University of Michigan Assistant Professor Umayyah Cable claimed theirs was even smaller.
“$2.64 for the pleasure of being inordinately susceptible to identity theft for life,” Cable said.
One Twitter user in particular, Wagner Koop, had a theory on why they received a bit more: $22.82.
“Judging by the most common payments I’ve seen ranging from $1 to $5, [it] means they really particularly fumbled my data,” Koop wrote.
Documents filed with the Federal Trade Commission paint a detailed picture of why the payments were drastically smaller than what was originally offered. Of the $700 million settlement, $425 million was dedicated to consumer restitution.
Further, only $31 million of that was set aside for the $125 payments. The court ordered the payments to “be reduced on a pro rata basis” if the number of claimants exceeded that budget, meaning each person’s payment would be reduced proportionally.
Neither JND nor Equifax has shared any data on just how many of the 147 million Americans affected took part in the settlement. However, $31 million divided into $125 payments is only enough for 248,000 people to equally receive their share. If the average pro rata payout was $5.21, that suggests roughly 5.95 million of the Americans affected filed claims. Each person would’ve only received 21 cents if all 147.9 million people in the breach joined the settlement.
Investigators have since tied the Equifax breach to hackers associated with the Chinese military. The credit monitoring agency maintained in its Dec. 19 announcement that no harm has come to consumers since then.
“There remains no evidence that the data obtained during the 2017 cyber attack perpetrated by Chinese military-based hackers against Equifax has been sold or used,” a company spokesperson wrote. “Over the last five years, few companies have invested more time and resources than Equifax to ensure that consumers’ information is protected.”