Equifax Reveals An Additional 2.5 Million Data Breach Victims

It’s been about six months since Equifax first announced it was hit by a major cyberattack that exposed sensitive information of more than 143 million people.

Equifax announced Thursday that an additional 2.4 million people had information stolen. That brings the total number impacted by last year’s massive data breach to 147.9 million.

Meanwhile the number of lawsuits from banks and consumers are piling up.

Bernard Lieberman of Atlanta is one of the victims. Standing outside Equifax headquarters in midtown, he talks about how someone tried to open a credit card in his name two weeks after the breach:

“I get a phone call from All-Clear Monitoring service asking me if I was responsible for this credit inquiry,” Lieberman said. “And the answer was no. Someone was trying to hack in.”

Since making the data breach public on Sept. 7, Equifax has disclosed that even more people were impacted. In October, they announced 2.5 million more people were impacted. On Thursday, it announced part of people’s driver’s license information was stolen from 2.4 million U.S. consumers.

Equifax said it identified the additional cybersecurity victims while going through company records as part of its ongoing investigation.

On its website, Equifax said the data stolen was partial because “in the vast majority of cases” it did not include people’s home addresses, driver’s license states, dates of issuance, or expiration dates.

Equifax said it will notify the additional 2.4 million customers by U.S. Postal mail, and will offer free identity theft protection and credit file monitoring services.

Class-Action Allegations

Already, there are more than 300 class action complaints in federal courts against Equifax.

Judge Thomas Thrash of the Northern District Court of Georgia in Atlanta has selected a team of 26 attorneys to combine these complaints and get through them more quickly.

Nine of the 26 attorneys are from Atlanta and includes former Georgia Governor Roy Barnes.

One of the lead attorneys on the case, Ken Canfield of Atlanta, said it’s not clear how long the case could drag on.

“That’s an impossible question to answer at this point,” Canfield said. “Typically cases of this magnitude take a while to resolve. In the Home Depot data breach case, which was also in Atlanta in front of the same judge, the settlement was about a year and a half after the data breach was announced.”

Canfield said it could take up to a year before it’s officially designated as a class-action lawsuit.

University of Georgia law professor and class-action expert Elizabeth Burch said a year and a half is pretty rare. She said many class-action lawsuits can take five to seven years.

Burch said the case could go to trial or attorneys could approve a class-action settlement. How much each person could get from the settlement depends on how many people file claims.

“They probably have all of our financial data so one would hope that they would direct deposit it back into our account,” Burch said. “But that’s part of the game. They don’t want that many people actually filing claims so they make the claims filing procedure more difficult, which means that ultimately they’ll have to pay out less money.”

Equifax did not respond to requests for comment.

The company has offered free identity theft and credit monitoring services for those impacted and unlimited credit locks.

WABE reporter Miranda Hawkins contributed to this report.