Equifax, Inc.

Documents in this case

• Complaint · July 2019 · 26 p.
• Stipulation · July 2019 · 81 p.

Case summary

On July 22, 2019, the Consumer Financial Protection Bureau (Bureau), the Federal Trade Commission (FTC), and 48 states, the District of Columbia and Puerto Rico entered into a global settlement with Equifax that provides up to $700 million in monetary relief and penalties. In a complaint and stipulated judgment filed in federal district court in the Northern District of Georgia, the Bureau alleges that Equifax, Inc. engaged in unfair and deceptive practices in connection with the 2017 data breach of Equifax’s systems that impacted approximately 147 million consumers. The approved settlement with the Bureau provides up to $425 million in monetary relief to consumers, a $100 million civil money penalty, and other relief. The Bureau coordinated its investigation with the FTC and attorneys general from across the country. In total, the settlements with these entities impose up to $700 million in relief and penalties.

Complaint (July 2019)

PDF of this document (26 pages)

Page 2

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 1 of 26

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF GEORGIA ATLANTA DIVISION

BUREAU OF CONSUMER FINANCIAL PROTECTION,

Plaintiff, Vv.

EQUIFAX INC.,

Defendant.

Civil Action Number:

COMPLAINT FOR PERMANENT INJUNCTION AND OTHER RELIEF

Plaintiff, the Bureau of Consumer Financial Protection (“Bureau”), alleges:

1. The Bureau brings this action under Sections 1031(a), 1036(a)(1), and

1054 of the Consumer Financial Protection Act of 2010 (“CFPA”), 12 U.S.C.

§§ 5531(a), 5536(a)(1), and 5564, to obtain permanent injunctive relief, restitution,

disgorgement, damages, civil money penalties, and other relief for Defendant’s

violations of the CFPA.

JURISDICTION AND VENUE

2. This Court has subject matter jurisdiction pursuant to 12 U.S.C.

§ 5565(a)(1).

Page 3

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 2 of 26

3. Venue is proper in the United States District Court for the Northern District of Georgia because Defendant does business and maintains its principal place of business in this District, 28 U.S.C. §§ 1391(b), and 12 U.S.C. § 5564(f).

PARTIES

4. Plaintiff Bureau is an independent agency of the United States Government created by the CFPA. 12 U.S.C. § 5491(a). The Bureau is charged with enforcing Federal consumer financial laws, including the CFPA. 12 U.S.C. §§ 5531(a), 5564(a)-(b), 5481(12) and (14).

5. The Bureau is authorized to initiate federal district court proceedings, by its own attorneys, to address violations of Federal consumer financial law, including the CFPA. 12 U.S.C. § 5564(a)-(b). Sections 1031 and 1036(a) of the CFPA, 12 U.S.C. §§ 5531 and 5536(a), prohibit unfair, deceptive, or abusive acts or practices, or other violations of Federal consumer financial law, by any covered person or service provider. The Bureau is authorized to secure any appropriate legal or equitable relief with respect to a violation of Federal consumer financial law, including, without limitation, permanent injunctive relief, restitution, disgorgement, damages, civil money penalties, and other relief. 12 U.S.C.

§ 5565(a).

Page 4

Case 1:19-cv-03300-TWT Document 1 Filed 07/22/19 Page 3 of 26

6. Defendant Equifax Inc. (“Equifax” or “Defendant”), is a Georgia corporation with its principal place of business at 1550 Peachtree St., NW, Atlanta, Georgia 30309. Equifax transacts business in this district and throughout the United States.

7. Defendant collects, analyzes, maintains or provides consumer report information or other account information, including information related to the credit history of consumers, used or expected to be used in connection with any decision regarding the offering or provision of a consumer financial product or service. Thus, Defendant provides a financial product or service covered by the CFPA, 12 U.S.C. § 5481(15)(A)(ix). This financial product or service includes providing consumer reports, credit file disclosures, credit scores, and the ability to freeze or lock consumer credit files. Defendant offers or provides these financial products or services to consumers primarily for personal, family, or household purposes, and delivers, offers, and provides them in connection with a consumer financial product or service such as consumer credit. Defendant is therefore engaged in offering or providing a consumer financial product or service and thus is a covered person within the meaning of the CFPA, id. § 5481(6). Consumer reports, credit file disclosures, credit scores, and the ability to freeze or lock

consumer credit files are consumer financial products or services because (i) they

Page 5

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 4 of 26

are consumer reports or other account information, including information relating to the credit history of consumers that Defendant collects and maintains about a consumer’s account, and (ii) they are offered or provided for use by consumers primarily for personal, family, or household purposes or are delivered, offered, or provided in connection with a consumer financial product or service.

DEFENDANT’S BUSINESS PRACTICES

8. Defendant offers various credit reporting and information products and services to businesses and consumers. Defendant collects, processes, stores and maintains vast quantities of consumers’ personal information, including personal information about more than 200 million U.S. consumers. Consumers have no control over what information businesses share with the Defendant, little control over what Defendant does with that information, and no control over how, or whether, that information is protected.

9. Defendant warehouses much of this information in its primary U.S. credit reporting database, known as Automated Credit Reporting Online (“ACRO”). Defendant uses ACRO to provide credit reports, credit scores, collections, and prescreening products, among other things.

10. Defendant also maintains on its network a system referred to as the

Automated Consumer Interview System (“ACIS”). ACIS is a network of

Page 6

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 5 of 26

applications and automated processes that handles consumer questions, concerns, and disputes regarding consumer credit data. Among other things, the ACIS network services an online dispute portal (the “ACIS Dispute Portal”), a web application where consumers can dispute items appearing on their consumer credit reports and upload supporting documentation. ACIS also services Defendant’s platform for consumer credit freezes and fraud alerts, as well as all consumer requests for a free annual file disclosure through AnnualCreditReport.com (“ACR”).

11. When a consumer disputes issues on his credit report through the ACIS Dispute Portal or otherwise transacts with Defendant for a consumer product or service (such as a subscription to a credit monitoring product, a request to freeze the consumer’s credit, or a request for a free credit report from ACR), the consumer must first submit sensitive personal information. For example, a consumer who requests a free credit report from ACR must submit, among other things, a name, date of birth, and Social Security number (“SSN”). A consumer who requests a security freeze or a copy of their credit score or credit report must submit similar personally identifiable information (“PII”), as well as a credit card

number and expiration date if a purchase is being made. Defendant logs and stores

Page 7

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 6 of 26

consumers’ PII in databases connected to ACIS. These databases thus contain hundreds of millions of records of sensitive consumer personal information.

12. ACIS was originally built in the 1980s. It was designed to connect to ACRO and runs on outdated systems, many of which are no longer supported. Today, Defendant considers ACIS to be legacy infrastructure and its own documents describe the system as “archaic” and using “antiquated technology.” As of 2016, about 25 million consumers interact with ACIS every year, with about 6.6 million of those consumers disputing transactions in their credit reports.

DEFENDANT’S 2017 DATA BREACH

13. On or about September 7, 2017, Defendant publicly disclosed a massive data breach (the “Breach”) involving the theft of sensitive consumer personal information from nearly 148 million consumers. As described below, the Breach resulted from Defendant’s failures to undertake numerous basic security measures to secure the PII stored in databases connected to the ACIS Dispute Portal.

14. Onor about March 8, 2017, the United States Computer Emergency Readiness Team (“US-CERT”) alerted Defendant to a new critical security vulnerability (referred to as 2017-CVE-5638) found in Apache Struts, an open

source framework used to build Java web applications. The alert encouraged

Page 8

Case 1:19-cv-03300-TWT Document 1 Filed 07/22/19 Page 7 of 26

anyone using a vulnerable version of the software to update the software to a new version released by the Apache Software Foundation, which was available for free online to all Apache software users. Within days, press reports indicated that attackers had already begun to exploit this critical vulnerability.

15. Defendant’s security team received the US-CERT alert and, on or about March 9, 2017, disseminated the alert internally by a mass email to more than 400 employees. The mass email directed employees, “if [they were] responsible for an Apache Struts installation,” to patch the vulnerability within 48 hours, as required by Defendant’s Patch Management Policy.

16. The ACIS Dispute Portal contained a vulnerable version of Apache Struts. However, Defendant failed to apply the patch to the ACIS Dispute Portal for months. Defendant’s security team issued an order to patch all vulnerable systems within 48 hours, yet Defendant failed to include the employee responsible for maintaining the ACIS Dispute Portal on the mass email ordering a patch. As a result, the ACIS Dispute Portal was not patched, and the fact that the ACIS Dispute Portal was unpatched went unnoticed.

17. On or about March 15, 2017, Defendant performed an automated vulnerability scan intended to search for vulnerable instances of Apache Struts that

remained on Defendant’s network. But Defendant used a scanner that was not

Page 9

Case 1:19-cv-03300-TWT Document 1 Filed 07/22/19 Page 8 of 26

configured to correctly search all of Defendant’s potentially vulnerable assets. As a result, the automated scanner did not identify any systems vulnerable to 2017- CVE-5638 and the ACIS Dispute Portal remained unpatched.

18. Defendant failed to discover the unpatched vulnerability for more than four months. On or about July 29, 2017, Defendant’s security team identified some suspicious traffic on the ACIS Dispute Portal after replacing expired security certificates. Defendant’s security personnel blocked the suspicious traffic but identified additional suspicious traffic the next day, at which time Defendant took the ACIS Dispute Portal offline.

19. Defendant retained a forensic consultant who ultimately determined that between May 13, 2017, and July 30, 2017, multiple attackers were each able to separately exploit the 2017-CVE-5638 vulnerability in the ACIS Dispute Portal to gain unauthorized access to Defendant’s network. Once inside, the attackers were able to crawl through dozens of unrelated databases containing information that went well beyond the ACIS Dispute Portal, in part because of a lack of network segmentation. The attackers also accessed an unsecured file share (or common storage space) connected to the ACIS databases where they discovered numerous administrative credentials, stored in plain text, that they used to obtain further

access to Defendant’s network, including the ACIS databases. By August 11,

Page 10

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 9 of 26

2017, Defendant had determined that the attack had compromised a large amount of consumer PII.

20. During the months that the attackers were able to operate undetected on Defendant’s network, the attackers ran nearly ten thousand queries on Defendant’s databases. These queries were specifically designed to identify SSNs, dates of birth, and other sensitive consumer information most valuable for identity theft.

21. According to Defendant’s forensic analysis, the attackers were able to steal approximately 147 million names and dates of birth, 145.5 million SSNs, 99 million physical addresses, 20.3 million telephone numbers, 17.6 million email addresses, and 209,000 payment card numbers and expiration dates, among other things. This data, in part, came from consumers who had previously obtained direct-to-consumer products from Defendant, such as credit scores, credit monitoring, and identity theft prevention products (“DTC Products”), as well as from consumers who had requested a free copy of their Equifax credit report through ACR.

22. The attackers were able to infiltrate the network and exfiltrate large volumes of consumer personal information due to a series of basic security failures

that Defendant failed to address, including:

Page 11

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 10 of 26

A. Defendant failed to patch 2017-CVE-5638, a critical vulnerability. Defendant’s patch management policies and procedures, which did not require any of Defendant’s more than four hundred employees to acknowledge receipt of a critical patch directive or otherwise confirm that a critical patch was applied, directly contributed to this failure.

B. Defendant’s reliance on an automated vulnerability scanner — without any other compensating controls to ensure that the vulnerability had been fully addressed — further contributed to Defendant’s failure to patch the vulnerability. Although many companies use automated vulnerability scanners, Defendant (1) did not maintain an accurate inventory of public facing technology assets running Apache Struts (and therefore did not know where the scanner needed to run) and (2) relied on a scanner that was not configured to search through all potentially vulnerable public facing websites.

C. Defendant failed to segment the database servers connected to ACIS, a failure that permitted the attackers to easily gain access to vast amounts of information related to a broad variety of Equifax consumer products and services. The attackers did not need complex or advanced tools to

pivot across Defendant’s network.

Page 12

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 11 of 26

D. Defendant left a file share connected to the ACIS databases where it was easily accessible by the attackers. The file share contained numerous administrative credentials and passwords in plain text. The file share also contained PII and was not protected by access controls. The attackers were able to leverage the credentials and passwords to access and comb through dozens of unrelated databases, including databases maintained by Defendant to support its consumer reporting activities, searching for sensitive consumer personal information.

E. Defendant stored more than 145 million SSNs and other sensitive consumer personal information in plain text, contrary to its own policies that require strong encryption and access controls for such PII.

F. Defendant had minimal protections for detecting intrusions on “legacy” technology systems, such as ACIS, which contributed to Defendant’s months-long failure to detect the attackers on its network. For instance, the ACIS system lacked any File Integrity Monitoring, which would have alerted Defendant to unauthorized activity within the ACIS environment, In addition, Defendant failed to update expired security certificates on the ACIS Dispute Portal, which prevented Defendant

from using tools in its possession that would have decrypted suspicious

Page 13

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 12 of 26

traffic. The security certificate on the ACIS Dispute Portal had expired at least 10 months before the discovery of the Breach.

DEFENDANT’S DATA SECURITY PRACTICES

23. Defendant engaged in a number of practices that, taken together, failed to provide reasonable security for the massive quantities of sensitive personal information stored within Defendant’s computer network. Among other things:

A. Defendant failed to implement reasonable procedures to detect, respond to and timely correct critical and other high-risk security vulnerabilities across Defendant’s systems, including:

i. Patch management policies and procedures that failed to ensure the timely remediation of critical security vulnerabilities;

ii. | Widespread noncompliance with Defendant’s patch management policy, including unpatched critical and high-risk vulnerabilities across Defendant’s systems that persisted for months;

iii. A failure to implement reasonable intrusion protection controls in

legacy systems, including:

Page 14

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 13 of 26

iv.

a) Failures to implement host and network intrusion prevention or file integrity monitoring that could have identified unauthorized access to Defendant’s network; and

b) Failures to maintain security certificates that would have allowed Defendant to examine traffic for suspicious activity;

Failures to implement readily-available protections, including

many low-cost protections, against well-known and reasonably

foreseeable vulnerabilities that could be exploited to gain unauthorized access to consumers’ sensitive personal information and local networks, such as Cross-Site Scripting (““XSS”),

Structured Query Language (“SQL”) injection, security

misconfigurations, and other common vulnerabilities;

B. Defendant failed to use readily available security measures to segment

its servers and databases;

C. Defendant failed to implement or enforce reasonable access controls to

prevent unauthorized access to sensitive consumer personal

information. For example:

Defendant stored numerous administrative credentials with

access to sensitive consumer personal information in plain text;

Page 15

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 14 of 26

ii. | Defendant copied sensitive consumer personal information, including SSNs, to numerous systems for development and testing purposes, which were accessible by employees and contractors without any business need;

iii. | Defendant failed to monitor or log privileged account activity across numerous systems; and

iv. Until at least 2017, Defendant failed to limit administrative tights for any of its employees on company-issued PCs and other devices, and allowed users to install any software or alter configurations;

D. Defendant stored the sensitive personal information in plain text, including hundreds of millions of SSNs and payment card information, including credit card account numbers provided by consumers to Defendant to pay for DTC Products; and

E. Defendant failed to provide adequate security training for engineers and other employees.

24. Defendant could have prevented or mitigated the failures described in Paragraphs 22-23 through cost-effective measures suitable for an organization of

Defendant’s size and complexity.

Page 16

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 15 of 26

25. Internal company documents, since at least 2014, clearly demonstrate Defendant’s awareness and actual knowledge of the failures described in Paragraphs 22-23.

26. Defendant’s failure to reasonably secure the sensitive consumer personal information in its network, described in Paragraphs 22-23, has resulted in substantial injury to approximately 147 million consumers whose personal information was stolen. These injuries may include wasted time and money to secure personal accounts and consumer reports from future identity theft, the cost of obtaining additional credit monitoring products or security freezes, and a significant risk of becoming victims of identity theft in the future. Additionally, because information such as SSNs and dates of birth are immutable, identity thieves could wait years before capitalizing on the stolen information. Thus, Defendant’s security failures are likely to continue to substantially injure consumers in the future. In addition to the injury to consumers from having to spend time and money taking measures to protect their identities, Defendant’s failures caused or are likely to cause consumers to experience identity theft.

DEFENDANT’S SECURITY REPRESENTATIONS TO CONSUMERS

27. Since at least October 2013, Defendant has maintained a privacy

policy for Defendant’s direct-to-consumer offerings, including credit scores, credit

Page 17

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 16 of 26

monitoring and identity management services, provided by Equifax Consumer Services LLC, which states:

We are committed to protecting the security of your information through procedures and technologies designed for this purpose by taking these steps: We limit access to your personal information to employees having a reasonable need to access this information to provide products and services to you ... We have reasonable

physical, technical, and procedural safeguards to help protect your personal information.

28. In fact, as described above in Paragraphs 22-23, Defendant’s security practices did not live up to the representations contained in these privacy policies. First, as previously described, Defendant did not limit access to personal information only to employees having a reasonable need to access the information. In many instances, Defendant stored sensitive personal information obtained from consumers who purchased Defendant’s DTC Products in systems without any access controls where employees and contractors could access it without any business need. Second, Defendant’s many security failures described in Paragraphs 22-23 failed to provide reasonable technical, physical, or procedural safeguards for consumer data on Defendant’s network.

DEFENDANT’S ACTS AND PRACTICES IN RESPONSE TO THE BREACH

29. Inresponse to the Breach, Defendant engaged in acts and practices

that caused additional harm or risk of harm to consumers.

Page 18

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 17 of 26

30. Defendant created a dedicated website, www.equifaxsecurity2017.com (“Incident Website”), to allow consumers to determine whether their information was compromised in the Breach and to take remedial action, such as enrolling in Defendant’s free credit monitoring product (“TrustedID Premier”) or freezing their Equifax credit reports.

31. Defendant deployed the Incident Website in a manner that exposed consumers to additional security risks and delayed or impeded their efforts to take remedial actions.

32. When Defendant deployed the Incident Website on September 7, 2017, the Incident Website contained an XSS vulnerability. An XSS vulnerability exposes consumers to the risk that attackers will run harmful code on the site that can, among other things, capture consumers’ sensitive personal information. Defendant patched the vulnerability within a few days, but by that time, millions of consumers had already visited the Incident Website and were exposed to this additional risk of harm.

33. Defendant also deployed the Incident Website in a way that made it impossible for visitors to distinguish between the actual site and malicious lookalike “phishing” sites created by criminals seeking to steal or “phish”

consumers’ PII in the wake of the Breach. Defendant did so by (a) hosting the

Page 19

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 18 of 26

Incident Website on a different domain than its primary website (Equifax.com) and (b) registering the Incident Website in a manner that could not be traced back to Defendant as the owner and operator of the website. The Incident Website thus lacked typical indicia of legitimacy that would allow consumers to distinguish the website from phishing websites set up by criminals. Defendant’s actions therefore made phishing easier for criminals and increased consumers’ risk of falling victim to a phishing attack.

34. Consumers who were able to place a security freeze were exposed to additional risk of harm by Defendant. When a consumer signed up for a security freeze of her Equifax credit report, Defendant assigned the consumer a 10-digit personal identification number (“PIN”) that she must use if she chooses to lift (or “thaw”) the freeze in the future. From September 7, 2017, through September 11, 2017, Defendant assigned PINs that reflected the date and time that the consumer requested a security freeze. For example, if a consumer requested a security freeze at 2:15pm Eastern Time on September 8, 2017, Defendant assigned her the PIN number 0908171415. ,

35. Time and date stamp PINs are much more predictable than random PINs and are therefore vulnerable to brute-force attacks and other types of

intrusions. Defendant’s failure to provide sufficiently secure PINs was especially

Page 20

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 19 of 26

problematic given that to lift a security freeze, an attacker needs only the PIN and the type of personal information already exfiltrated in the Breach.

36. Defendant did not contact or automatically re-assign random PINs to consumers who received non-random PINs prior to September 11, 2017.

37. Consumers were dependent on Defendant for information and services they needed to mitigate harm from the Breach (such as determining whether they were affected, placing a security freeze on their Equifax credit reports, and enrolling in TrustedID Premier). Defendant alone could provide these services to consumers. Further, consumers could not control how Defendant generated its “thaw” PINs and most consumers lacked Defendant’s knowledge of basic flaws on the Incident Website.

38. By deploying the Incident Website and assigning security freeze PINs in a manner that exposed consumers to additional security risks, Defendant injured, or was likely to injure, consumers. Defendant exposed millions of consumers who had already been victimized by the Breach to additional risks that their information would be compromised and misused by criminals. Defendant’s actions in response to the Breach also delayed and deterred consumers from mitigating the risk of

identity theft or other misuse of their PII through protective measures.

Page 21

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 20 of 26

VIOLATIONS OF SECTIONS 1031 AND 1036 OF THE CFPA

39, Sections 1031 and 1036(a)(1)(B) of the CFPA, 12 U.S.C. §§ 5531 and 5536(a)(1)(B), prohibit covered persons from engaging “in any unfair, deceptive, or abusive act or practice.” A representation, omission, act, or practice is deceptive under the CFPA when it misleads or is likely to mislead the consumer, the consumer’s interpretation of it is reasonable under the circumstances, and it is material. Acts or practices are unfair under the CFPA if “the act or practice causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers” and “such substantial injury is not outweighed by countervailing benefits to consumers or competition.” 12 U.S.C. § 5531(¢).

Count I: Unfair Acts and Practices Regarding Defendant’s Data Security Practices

40. Innumerous instances, Defendant has failed to provide reasonable security for the sensitive consumer personal information collected, processed, maintained or stored within Defendant’s computer networks.

41. Defendant’s actions caused or are likely to cause substantial injury to consumers that consumers cannot reasonably avoid and that is not outweighed by

countervailing benefits to consumers or competition.

Page 22

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 21 of 26

42. Defendant’s practices as described in Paragraph 40 above constitute unfair acts or practices in violation of the CFPA, 12 U.S.C. §§ 5531 (a) and (c), and 12 U.S.C. § 5536(a)(1)(B).

Count II: Deceptive Acts and Practices Regarding Defendant’s Data Security to Consumers

43. Through the means described in Paragraph 27, Defendant has represented, directly or indirectly, expressly or by implication, that Defendant limits access to consumer personal information to employees having a reasonable need to access this information to provide products and services to consumers, and that Defendant has reasonable physical, technical, and procedural safeguards to protect consumer personal information, for Defendant’s DTC Products.

44. In truth and in fact, in numerous instances, Defendant failed to limit access to consumer personal information to employees having a reasonable need to access this information and lacked reasonable physical, technical, or procedural safeguards to protect this information.

45. Defendant’s representations were likely to mislead consumers acting reasonably under the circumstances.

46. Defendant’s representations were material because they were likely to affect a consumer’s choice regarding whether to purchase or continue purchasing

DTC Products from Equifax.

Page 23

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 22 of 26

47. Defendant’s representations as set forth in Paragraph 43 are false or misleading and constitute a deceptive act or practice in violation of the CFPA, 12 U.S.C. §§ 5531(a) and 5536(a)(1)(B).

Count Ill: Unfair Acts and Practices Regarding Defendant’s Response to the Data Breach

48. Defendant’s acts and practices in response to the Breach, as set forth in Paragraphs 29-38, caused or were likely to cause substantial injury to consumers that consumers cannot reasonably avoid themselves and that is not outweighed by countervailing benefits to consumers or competition.

49. Defendant provided an Incident Website and security freeze PINs in a manner that injured, or was likely to injure, consumers. Defendant exposed millions of consumers who had already been victimized by the Breach to additional risks that their information would be compromised and misused by criminals.

50. Consumers could not reasonably avoid the harm they have experienced as a result of Defendant’s acts and practices in response to the Breach. Consumers were dependent on Defendant for information and services they needed to mitigate harm from the Breach, such as determining whether they were affected, placing a security freeze on their Equifax credit files, and enrolling in TrustedID

Premier. Further, consumers could not control how Defendant generated its

Page 24

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 23 of 26

“thaw” PINs and most consumers lacked detailed information about the security flaws on the Incident Website.

51. The injuries sustained or likely to be sustained by consumers are not outweighed by countervailing benefits to consumers or to competition. Defendant could have provided random PINs or implemented readily-available protections to secure the Incident Website from well-known and reasonably foreseeable vulnerabilities, at little or no extra cost, and any savings from Defendant’s failure to design and implement these security measures did not benefit consumers or competition. Even if Defendant’s failure to reasonably secure the Incident Website provided some countervailing benefits to consumers or competition, such benefits are not outweighed by the additional risks and injuries to which Defendant exposed consumers.

52. Defendant’s practices as described in Paragraph 48 above constitute unfair acts or practices in violation of the CFPA, 12 U.S.C. §§ 5531(a) and (c), and 12 U.S.C. § 5536(a)(1)(B).

CONSUMER INJURY

53. Consumers have suffered and will continue to suffer substantial injury as a result of Defendant’s violations of the CFPA. In addition, Defendant has been

unjustly enriched as a result of its unlawful acts or practices. Absent injunctive

Page 25

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 24 of 26

relief by this Court, Defendant is likely to continue to injure consumers, reap unjust enrichment, and harm the public interest.

THIS COURT’S POWER TO GRANT RELIEF

54. Section 1055 of the CFPA, 12 U.S.C. § 5565, empowers this Court to “rant any appropriate legal or equitable relief with respect to a violation of Federal consumer financial law” including the CFPA. This relief includes rescission, refund of monies, restitution, disgorgement or compensation for unjust enrichment, payment of damages or other monetary relief, public notification regarding the violation, limits on the activities or functions of the person, and civil money penalties. 12 U.S.C. § 5565(a)(2). In addition, the Bureau may recover its costs in connection with the action, if it is the prevailing party. 12 U.S.C. § 5565(b).

PRAYER FOR RELIEF

55. Wherefore, Plaintiff Bureau, pursuant to Sections 1054 and 1055 of the CFPA, 12 U.S.C. §§ 5564 and 5565, and the Court’s own equitable powers, requests that the Court:

A. Permanently enjoin Defendant from committing unfair and deceptive acts or practices in connection with its provision of consumer financial —

products or services to consumers;

Page 26

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 25 of 26

B. Award such relief as the Court finds necessary to redress injury to consumers resulting from Defendant’s violations of the CFPA, including but not limited to rescission or reformation of contracts, restitution, refund of monies paid, disgorgement of ill-gotten monies, and payment of damages and other monetary relief;

C. Award the Bureau civil money penalties for Defendant’s violations of the CFPA;

D. Award the Bureau the costs of bringing this action; and

E. Award additional relief as the Court may determine to be Just and

proper.

Page 27

Case 1:19-cv-03300-TWT Document1 Filed 07/22/19 Page 26 of 26

Dated: July 22, 2019

LOCAL COUNSEL:

BYUNG J. PAK United States Attorney

/s/ Akash Desai

AKASH DESAI Assistant U.S. Attorney Georgia Bar No. 338124 600 U.S. Courthouse

75 Ted Turner Drive SW Atlanta, Georgia 30303 Telephone: 404-581-6364 Facsimile: 404-581-6181

FOR PLAINTIFF:

BUREAU OF CONSUMER FINANCIAL PROTECTION

CARA PETERSEN Acting Enforcement Director

JOHN WELLS Deputy Enforcement Director

/s/ Jenelle M. Dennis JENELLE M. DENNIS D.C. Bar No. 494958 RICHA DASGUPTA D.C. Bar No. 500509

P. SOLANGE HILFINGER-PARDO

California Bar No. 320055 EMILY MINTZ SACHS Virginia Bar No. 82437

Bureau of Consumer Financial Protection

1700 G Street, NW Washington, D.C. 20552

Telephone: (202) 435-9118 (Dennis)

Facsimile: (202) 425-7722 Email: [email protected]

Stipulation (July 2019)

PDF of this document (81 pages)

Page 28

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF GEORGIA ATLANTA DIVISION BUREAU OF CONSUMER FINANCIAL PROTECTION, Plaintiff, v.

EQUIFAX INC., Defendant.

Civil Action Number:

1:19-cv-3300-TWT Plaintiff, the Bureau of Consumer Financial Protection ("Bureau"), has filed its Complaint for a permanent injunction, civil penalties, and other relief in this matter. The Bureau brought this action pursuant to Sections 103 l(a), 1036(a)(l), and 1054 of the Consumer Financial Protection Act of 2010 ("CFPA"), 12 U.S.C. §§ 5531(a), 5536(a)(l), and 5564, and sought relief, including civil penalties, pursuant to Section 1055 of the CFPA, 12 U.S.C. § 5565(c). Defendant Equifax Inc. ("Defendant" or "Equifax") waived service of the summons and the Complaint. The Bureau and Defendant stipulate to entry of this Order for Permanent Injunction and Monetary Judgment ("Order") to resolve all claims in dispute in this action between them.

STIPULATED ORDER FOR PERMANENT INJUNCTION AND MONETARY JUDGMENT Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 1 of 81

Page 29

Ww

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 2 of 81

THEREFORE, IT [S ORDERED as follows:

FINDINGS

This Court has jurisdiction over this matter.

The Complaint alleges claims for relief under Sections 1031(a) and 1036(a)(1) of the CFPA, 12 U.S.C. §§ 5531(a) and 5536(a)(1).

Defendant neither admits nor denies any of the allegations in the Complaint, except as specifically stated in this Order. For purposes of this Order, Defendant admits the facts necessary to establish jurisdiction over it and the subject matter of this action.

Defendant waives any claim that it may have under the Equal Access to Justice Act, 28 U.S.C. § 2412, concerning the prosecution of this action through the date of this Order, and agrees to bear its own costs and attorneys’ fees.

All parties waive all rights to appeal or otherwise challenge or contest the validity of this Order.

Entry of the Order is in the public interest.

Page 30

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 3 of 81

DEFINITIONS

For purposes of this Order, the following definitions apply:

7.

10.

11.

“Affected Consumer” means the approximately One Hundred Forty Seven Million (147,000,000) U.S. consumers whom Defendant has identified as having their Personal Information accessed without authorization as a result of the Breach.

“Assisted Identity Restoration” means the identity restoration services offered to all Affected Consumers, as set forth in Subsection VII.D and described in Exhibit A.

“Breach” means the information security incident publicly disclosed by Defendant on or about September 7, 2017.

“Claims Administration Protocol” means the protocol that has been approved by the Bureau, and which will be submitted to and approved by the MDL Court, to implement the claims administration process consistent with Sections VII, IX, X and XI of this Order and the Class Action Settlement. “Class Action Settlement” means the settlement agreement, including release of settlement class member claims, filed in the Multi-District

Litigation with the MDL Court.

Page 31

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 4 of 81

12. “Class Action Effective Date” means the first business day after the MDL Court enters a Final Approval Order and Judgment, and either:

A. the time for appeal, petition, rehearing or other review has expired, or b. if one or more appeals, petitions, requests for rehearing or other reviews are filed, when:

i. the Final Approval Order and Judgment is affirmed without material change and the time for further appeals, petitions, requests for rehearing or other reviews has expired, or

ii. all appeals, petitions, rehearings, or other reviews are dismissed or otherwise disposed of, no other appeals, petitions, rehearings, or other reviews are pending, and the time for further appeals, petitions, requests for rehearing or other reviews has expired,

13. “Consumer Fund” means the account established to provide restitution and redress to Affected Consumers, as described in Sections IX, X, and XI, which will be overseen by the MDL Court and which represents an undifferentiated portion of the consumer restitution fund as defined in the

Class Action Settlement.

Page 32

14.

15.

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 5 of 81

“Consumer Report” has the meaning provided in the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. § 1681 et seq., and any amendments thereto. As of the date of this Order, “Consumer Report” is defined under the FCRA as any written, oral, or other communication of any information by a Consumer Reporting Agency bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living, which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in

establishing the consumer’s eligibility for:

a. credit or insurance to be used primarily for personal, family, or household purposes;

b. employment purposes; or

c. any other purpose authorized under the FCRA, Section 604, 15 U.S.C. § 1681b.

“Consumer Reporting Agency” has the meaning provided in the FCRA, 15

U.S.C. § 1681 ef seq., and any amendments thereto. As of the date of this

Order, “Consumer Reporting Agency” is defined under the FCRA as any

person which, for monetary fees, dues, or on a cooperative nonprofit basis,

regularly engages in whole or in part in the practice of assembling or

Page 33

16.

17.

18.

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 6 of 81

evaluating consumer credit information or other information on consumers for the purpose of furnishing Consumer Reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing Consumer Reports.

“Covered Incident” means any instance in which any United States federal, state, or local law or regulation requires Defendant to notify any U.S. federal, state, or local government entity that Personal Information collected or received, directly or indirectly, by Defendant from or about an individual consumer was, or is reasonably believed to have been, accessed or acquired without authorization, and the incident affects no fewer than 250 U.S. consumers.

“Defendant” means Equifax Inc., its successors and assigns, and its subsidiaries, their successors and assigns, incorporated in the United States, that do business in the United States, or that collect, store, or process Personal Information from or about consumers in the United States to the extent that Defendant’s conduct falls within the Bureau’s jurisdiction.

“Effective Date” means the date on which this Stipulated Order is issued.

Page 34

19.

20.

Zl.

pas

a3.

24.

2.

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 7 of 81

“Enforcement Director” means the Assistant Director of the Office of Enforcement for the Bureau of Consumer Financial Protection, or her delegate.

“Extended Claims Period” means the period beginning with the conclusion of the Initial Claims Period through four (4) years after the conclusion of the Initial Claims Period.

“Final Approval Order and Judgment” means an order and judgment that the MDL Court enters finally approving settlement, including release of the settlement class member claims in the Multi-District Litigation.

“RTC Order” means the Stipulated Order entered in the matter styled as Federal Trade Commission v. Equifax Inc., filed on or about July 22, 2019 in the Federal District Court for the Northern District of Georgia.

“Full Service Identity Restoration” means the identity restoration services offered to all Affected Consumers enrolled in the Product, as set forth in Subsection VII.A and described in Exhibit A.

“Initial Claims Period” means six (6) months after the MDL Court enters an order permitting issuance of notice of class action settlement for the Class Action Settlement.

“MDL Court” means the Court presiding over the Multi-District Litigation.

Page 35

26.

27.

29,

30,

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 8 of 81

“Multi-District Litigation’ means those actions filed against Equifax Inc. and/or one or more of its subsidiaries asserting claims related to the Breach by or on behalf of one or more consumers that have been or will be transferred to the federal proceedings styled Jn re: Equifax Inc. Customer Data Security Breach Litigation, 1:17-md-02800-TWT (N.D. Ga.).

“Notice Date” means the date sixty (60) days after the MDL Court issues an order permitting issuance of notice of class action settlement for the Class Action Settlement.

“Notice Plan” means the notice plan for providing notice to Affected Consumers which has been approved by a representative of the Bureau, and is to be submitted to, approved by, and overseen by the MDL Court. “Notice Provider” means an independent third-party agent or administrator approved by a representative of the Bureau, and which is to be submitted to, approved by, and overseen by the MDL Court to implement the notice provisions of the Notice Plan, and as set forth in Section X.

“Out-of-Pocket Losses” means verifiable unreimbursed costs or expenditures incurred by an Affected Consumer that are fairly traceable (as

described in the Claims Administration Protocol) to the Breach, which are

Page 36

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 9 of 81

eligible for reimbursement from the Consumer Fund as set forth in

Subsection [X.B.4, and defined as follows:

a. Costs incurred for credit monitoring services at any time between September 7, 2017 and the date of the Affected Consumer’s claim(s) submission;

b. Up to twenty-five percent (25%) reimbursement for costs incurred by an Affected Consumer enrolled in Equifax credit or identity monitoring subscription products at any time between September 7, 2016 and September 7, 2017;

c. Costs incurred by an Affected Consumer to place or remove a security freeze on a Consumer Report with any Consumer Reporting Agency at any time on or after September 7, 2017;

d. Unreimbursed costs, expenses, losses, or charges incurred as a result of identity theft or identity fraud, falsified tax returns, or other alleged misuse of the Affected Consumer’s Personal Information;

e. Reimbursement for Time Compensation; and

f. Miscellaneous expenses incurred by the Affected Consumer related to any Out-Of-Pocket Losses, such as notary, fax, postage, copying,

mileage, and telephone charges.

Page 37

31.

32.

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 10 of 81

“Personal Consumer Report” means, for purposes of this Order only, a Consumer Report made available to consumers by any entity within Defendant that compiles and maintains files on consumers on a nationwide basis as defined under 15 U.S.C, § 1681a(p).

“Personal Information” means individually identifiable information from or

about an individual consumer, including:

a. first and last name;

b. home or other physical address;

C; email address;

d. telephone number;

e. date of birth;

f. Social Security number;

g. other government-issued identification numbers, such as a driver’s license number, military identification number, passport number, or other personal identification number;

h. financial institution account number;

I. credit or debit card information; or

j. authentication credentials, such as a username and password.

Page 38

33.

34.

35.

36.

37.

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 11 of 81

“Preventative Measures” means placement or removal of security freezes or obtaining credit monitoring services.

“Product” means the credit monitoring, identity theft insurance, and identity restoration services further described in Subsection VILA and on pages 1-4 of Exhibit A, that has been approved by the Bureau and will be presented to the MDL Court for approval.

“Related Consumer Action” means any private action by or on behalf of one or more consumers, or enforcement action by another governmental agency, entity, or representative, brought against Defendant based on substantially the same facts as described in the Complaint.

“Settlement Administrator’ means an independent third-party agent or administrator that has been approved by the Bureau, which will be submitted to, approved by, and overseen by the MDL Court, and which will implement the claims and administration process in the Multi-District Litigation. “Settlement Website” means the website established by the Settlement Administrator that provides information to Affected Consumers about their rights and options consistent with Sections VII, LX, X and XI of this Order, including the components of the Consumer Fund available to Affected

Consumers, where and how Affected Consumers may submit claims during

1]

Page 39

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 12 of 81

the Initial and Extended Claims Periods, and all deadlines for making such claims.

38. “Single Bureau Monitoring” means credit monitoring provided by Defendant and offered to all Affected Consumers enrolled in the Product, as set forth in Subsection VII.B and described in Exhibit A.

39. “States” Attorneys General” means the 5O state and territory attorneys general that are each entering into a stipulated judgment on or about July 22, 2019 with Equifax Inc. for claims related to the Breach.

40. “Time Compensation” means compensation to an Affected Consumer for a valid claim for time spent by that Affected Consumer (1) taking Preventative Measures and/or (2) remedying fraud, identity theft, or other misuse of an Affected Consumer’s Personal Information that is fairly traceable to the Breach.

ORDER

I. PROHIBITION AGAINST MISREPRESENTATIONS IT IS ORDERED that Defendant, Defendant’s officers, agents, employees,

and all other persons in active concert or participation with any of them who receive actual notice of this Order, whether acting directly or indirectly, in

connection with any product or service, are hereby permanently restrained and

Page 40

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 13 of 81

enjoined from misrepresenting, expressly or by implication, the extent to which Defendant maintains and protects the privacy, security, confidentiality, or integrity

of any Personal Information.

ll. MANDATED INFORMATION SECURITY PROGRAM IT IS FURTHER ORDERED that Defendant shall establish and

implement, and thereafter maintain, for twenty (20) years after entry of this Order, a comprehensive information security program (“Information Security Program’) designed to protect the security, confidentiality, and integrity of Personal Information. To satisfy this requirement, Defendant must, at a minimum:

A. Document in writing the content, implementation, and maintenance of the

Information Security Program, including the following:

Us Documented risk assessment required under Subsection I.D; 2s Documented safeguards required under Subsection II.E; and 3 A description of the procedures adopted to implement and monitor the

Information Security Program, including procedures for evaluating and adjusting the Information Security Program as required under Subsection ILI.

B. Provide the written Information Security Program and any material

evaluations thereof or updates thereto to Defendant’s board of directors or a

Page 41

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 14 of 81

relevant subcommittee thereof, or equivalent governing body or, if no such board or equivalent governing body exists, to a senior officer of Defendant responsible for Defendant’ s Information Security Program at least once every twelve (12) months;

Designate a qualified employee or employees to coordinate, oversee, and be responsible for the Information Security Program,

Assess, at least once every twelve (12) months, internal and external risks to the security, confidentiality, or integrity of Personal Information that could result in the unauthorized disclosure, misuse, loss, alteration, destruction, or other compromise of such information and document those risks that are material. Defendant shall further assess and document internal and external risks as described above as they relate to a Covered Incident promptly (not to exceed forty-five days) following verification of such a Covered Incident; Design, implement, maintain, and document safeguards that control for the material internal and external risks Defendant identifies to the security, confidentiality, or integrity of Personal Information identified in response to Subsection D. Each safeguard shall be based on the volume and sensitivity of the Personal Information that is at risk, and the likelihood, given the

existence of other safeguards, that the risk could be realized and result in the

Page 42

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 15 of 81

unauthorized access, collection, use, alteration, destruction, or disclosure of

the Personal Information. Such safeguards shall also include:

l.

Ww

Establishing patch management policies and procedures that require confirmation that any directives to apply patches or remediate vulnerabilities are received and completed and that include timelines for addressing vulnerabilities that account for the severity and exploitability of the risk implicated;

Establishing and enforcing policies and procedures to ensure the timely remediation of critical and/or high-risk security vulnerabilities; Identifying and documenting a comprehensive information technology (“IT”) asset inventory that includes hardware, software, and location of the assets;

Designing and implementing protections such as network intrusion protection, host intrusion protection, and file integrity monitoring, across Defendant’s network and IT assets, including Defendant's legacy technologies;

Designing, implementing, and maintaining measures to limit

unauthorized access in any network or system that stores, collects,

Page 43

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 16 of 81

maintains, or processes Personal Information, such as segmentation of networks and databases and properly configured firewalls;

6. Implementing access controls across Defendant's network, such as multi-factor authentication and strong password requirements;

7. Limiting user access privileges to systems that provide access to Personal Information to employees, contractors, or other authorized third parties with a business need to access such information and establishing regular documented review of such access privileges;

8. Implementing protections, such as encryption, tokenization, or other at least equivalent protections, for Personal Information collected, maintained, processed, or stored by Defendant, including in transit and at rest. To the extent that any of the identified protections are infeasible, equivalent protections shall include effective alternative compensating controls designed to protect unencrypted data at rest or in transit, which shall be reviewed and approved by the qualified employee or employees designated to coordinate, oversee, and be responsible for the Information Security Program;

9. Establishing and enforcing written policies, procedures, guidelines,

and standards designed to:

Page 44

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 17 of 81

a. Ensure the use of secure development practices for applications developed in-house; and b. Evaluate, assess, or test the security of externally developed applications used within Defendant's technology environment; 10. Establishing regular information security training programs, updated, as applicable, to address internal or external risks identified by Defendant, including, at a minimum:

a. At least annual information security awareness training for all employees; and b. Training for software developers relating to secure software development principles and intended to address well-known and reasonably foreseeable vulnerabilities, such as cross-site scripting, structured query language injection, and other risks identified by Defendant through risk assessments and/or penetration testing;

11. Establishing a clear and easily accessible process for receiving and addressing security vulnerability reports from third parties such as

security researchers and academics; and

Page 45

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 18 of 81

\2. By August 30, 2019, establishing a clear and easily accessible process overseen by a senior corporate manager for employees to submit complaints or concerns about Defendant’ s information security practices, including establishing a clear process for reviewing, addressing, and escalating employee complaints or concerns.

Assess, at least once every twelve (12) months, the sufficiency of any

safeguards in place to address the risks to the security, confidentiality, or

integrity of Personal Information, and evaluate and implement any needed modifications to the Information Security Program based on the results,

Defendant shall further assess the sufficiency of safeguards as described

above as they relate to a Covered Incident promptly (not to exceed forty-five

days) following verification of such an incident. Each such assessment must evaluate safeguards in each area of relevant operation, including:

1. Employee training and management;

2. Information systems, such as network and software design, or information processing, storage, transmission, and disposal; and

3. Prevention, detection, and response to attacks, intrusions, or other

system failures;

Page 46

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 19 of 81

Test and monitor the effectiveness of the safeguards at least once every twelve (12) months and, as they relate to a Covered Incident promptly (not to exceed sixty (60) days) following verification of such an incident, and modify the Information Security Program based on the results. Such testing shall include vulnerability testing of Defendant’s network at least once every four (4) months and, as it relates to a Covered Incident, promptly (not to exceed sixty (60) days) following verification of such an incident, and penetration testing of Defendant’s network at least once every twelve (12) months and, as it relates to a Covered Incident promptly (not to exceed sixty (60) days) following verification of such an incident;

Select and retain service providers capable of safeguarding Personal Information they access through or receive from Defendant, and contractually require service providers to implement and maintain safeguards tailored to the amount and the type of Personal Information at issue; and

Evaluate and adjust the Information Security Program in light of any changes to Defendant’s operations or business arrangements, including, without limitation, acquisition or licensing of any new information systems,

technologies, or assets through merger or acquisition, a Covered Incident, or

Page 47

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 20 of 81

any other circumstances that Defendant knows or has reason to know may have a material impact on the effectiveness of the Information Security Program. At a minimum, Defendant must evaluate the Information Security Program at least once every twelve (12) months and, as it relates toa Covered Incident promptly (not to exceed sixty (60) days) following verification of such an incident and modify the Information Security

Program based on the results.

Ill. INFORMATION SECURITY ASSESSMENTS BY A THIRD PARTY IT IS FURTHER ORDERED that, in connection with compliance with

Section Il of this Order, titled Mandated Information Security Program, Defendant

must obtain initial and biennial assessments (“Assessments”):

A. | The Assessments must be obtained from a qualified, objective, independent third-party professional (“Assessor”), who: (1) uses procedures and standards generally accepted in the profession; (2) is a Certified Information Systems Security Professional (“CISSP”) or a Certified Information Systems Auditor (“CISA”), or other similarly qualified person or organization,

(3) has at least five (5) years of experience evaluating the effectiveness of computer system security or information system security; (4) conducts an

independent review of the Information Security Program; and (5) is

Page 48

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 21 of 81

contractually required to retain all documents relevant to each Assessment for five (5) years after completion of such Assessment, and to provide such documents to the Bureau within fourteen days of receipt of a written request from a representative of the Bureau. No documents may be withheld by the Assessor on the basis of (1) a claim of confidentiality, proprietary or trade secrets, or any similar claim, or (2) any privilege asserted between Defendant and Assessor, although such documents can be designated for confidential treatment in accordance with applicable law.

For each Assessment, Defendant shall provide the Enforcement Director with the name and affiliation of the person selected to conduct the Assessment, which the Bureau shall have the authority to approve in its sole discretion. If the Bureau does not approve of the person Defendant has selected, Defendant must choose a person or entity to conduct the Assessment from a list of at least three Assessors provided by a representative of the Bureau.

The reporting period for the Assessments must cover: (1) the first 180 days after the entry date of the Order for the initial Assessment; and (2) each twoyear period thereafter for twenty (20) years after entry of the Order for the

biennial Assessments.

Page 49

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 22 of 81

D. — Each Assessment must:

lL. Evaluate whether Defendant has implemented and maintained the Information Security Program required by Section II of this Order, titled Mandated Information Security Program;

2. Assess the effectiveness of Defendant’s implementation and maintenance of Subsections A-I of Section II;

3. Identify gaps or weaknesses in the Information Security Program and make recommendations to remediate or cure any such gaps and weaknesses; and

4. Identify specific evidence (including, but not limited to, documents reviewed, sampling and testing performed, and interviews conducted) examined to make such determinations, assessments, and identifications, and explain why the evidence that the Assessor examined is sufficient to justify the Assessor’s findings. No finding of any Assessment shall rely solely on assertions or attestations by Defendant’s management. The Assessment shall be signed by the Assessor and shall state that the Assessor conducted an independent review of the Information Security Program, and did not rely solely on

assertions or attestations by Defendant’s management.

Page 50

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 23 of 81

Each Assessment must be completed within sixty days after the end of the reporting period to which the Assessment applies. Unless otherwise directed by a Bureau representative in writing, Defendant must submit each Assessment to the Bureau within ten days after the Assessment has been completed via secure email to Enforcement_Compliance @cfpb.gov or by overnight courier (not the U.S. Postal Service) to Enforcement Director, Office of Enforcement, Bureau of Consumer Financial Protection, 1700 G Street NW, Washington, DC 20552. The subject line must begin, “Bureau of Consumer Financial Protection y. Equifax Inc., BCFP File No. 2017- 1906-02.” Defendant must notify the Bureau of any portions of the Assessment containing trade secrets, commercial or financial information, or information about a consumer or other third party, for which confidential treatment is requested pursuant to the Bureau's procedures concerning public disclosure set forth in 12 U.S.C. § §512(c)(6)(A) and 12 C.F.R.

§ 1070.20 (2018).

An Assessment required pursuant to this Section may be satisfied by an

assessment conducted in connection with the FTC Order.

Page 51

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 24 of 81

IV. COOPERATION WITH THIRD PARTY INFORMATION SECURITY ASSESSOR

IT IS FURTHER ORDERED that Defendant, Defendant's officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with any Assessment required by Section III of this Order titled Information Security Assessments by a Third Party, must not withhold any material facts from the Assessor, and must not misrepresent, expressly or by implication, any fact material to the Assessor’s: (1) evaluation of whether Defendant has implemented and maintained the Information Security Program required by Section II of this Order, titled Mandated Information Security Program; (2) assessment of the effectiveness of the implementation and maintenance of subsections A-I of Section II; or (3) identification of any gaps or weaknesses in the Information Security Program. Defendant shall provide the Assessor with information about the Defendant's entire network and all of Defendant’s IT assets so that the Assessor can determine the scope of the Assessment, and visibility to those portions of the network and IT assets deemed in scope. Defendant shall also provide or otherwise make available to the Assessor all information and material in its possession, custody, or control that is relevant to

the Assessment.

Page 52

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 25 of 81

Vv. ANNUAL CERTIFICATION [T IS FURTHER ORDERED that, in connection with compliance with

Section II of this Order titled Mandated Information Security Program, Defendant

shall:

A.

For a total of twenty (20) years and commencing one year after the entry date of this Order, and each year thereafter, provide the Bureau with a certification from the board of directors, or a relevant subcommittee thereof, or other equivalent governing body or, if no such board or equivalent governing body exists, a senior officer of Defendant responsible for Defendant’s Information Security Program, that: (1) Defendant has established, implemented, and maintained the requirements of this Order; (2) Defendant is not aware of any material noncompliance that has not been (a) corrected or (b) disclosed to the Bureau; (3) Defendant has cooperated with the Assessor as required by Section IV of this Order; and (4) includes a brief description of any Covered Incident. The certification must be based on the personal knowledge of the senior corporate manager, senior officer, or subject matter experts upon whom the board of directors, or relevant subcommittee thereof, or other equivalent governing body, reasonably relies

in making the certification.

Page 53

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 26 of 81

B. Unless otherwise directed by a Bureau representative in writing, submit all annual certifications to the Bureau pursuant to this Order via email to Enforcement_Compliance @cfpb.goy or by overnight courier (not the US. Postal Service) to Enforcement Director, Office of Enforcement, Bureau of Consumer Financial Protection, 1700 G Street NW, Washington, DC 20552. The subject line must begin, “Bureau of Consumer Financial Protection v.

Equifax Inc., BCFP File No. 2017-1906-02.”

VI. COVERED INCIDENT REPORTS IT IS FURTHER ORDERED that for twenty (20) years from the entry of the

Order, Defendant, within a reasonable time after the date of Defendant’s discovery of a Covered Incident, but in any event no later than ten days after the date Defendant first notifies any U.S. federal, state, or local government entity of the Covered Incident, must submit a report to the Bureau. A. — The report must include, to the extent possible:

Ts The date, estimated date, or estimated date range when the Covered

Incident occurred;

2. A description of the facts relating to the Covered Incident, including

the causes and scope of the Covered Incident, if known;

Page 54

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 27 of 81

¥, A description of each type of information that triggered the notification obligation to the U.S. federal, state, or local government entity;

A, The number of consumers whose information triggered the notification obligation to the U.S. federal, state, or local government entity;

3: The acts that Defendant has taken to date to remediate the Covered Incident and protect Personal Information from further exposure or access, and, if applicable, to protect affected individuals from identity theft or other harm that may result from the Covered Incident; and

6. A representative copy of each materially different notice required by U.S. federal, state, or local law or regulation and sent by Defendant to consumers or to any U.S. federal, state, or local government entity.

No more than thirty days after every calendar quarter, Defendant must

provide Defendant’s board of directors or relevant subcommittee thereof, or

equivalent governing body or, if no such board or equivalent governing body exists, fo a senior officer of Defendant responsible for Defendant's

Information Security Program, a report summarizing all Covered Incidents

that occurred in that calendar quarter.

Page 55

Vil.

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 28 of 81

Unless otherwise directed by a Bureau representative in writing, all Covered Incident reports to the Bureau pursuant to this Order must be emailed to the Bureau via secure email to Enforcement_Compliance @cfpb. gov or sent by overnight courier (not the U.S. Postal Service) to Enforcement Director, Office of Enforcement, Bureau of Consumer Financial Protection, 1700 G Street NW, Washington, DC 20552. The subject line must begin, “Bureau of Consumer Financial Protection v. Equifax Inc., BCFP File No. 2017- 1906-02.” Defendant must notify the Bureau of any portions of the Covered Incident Report containing trade secrets, commercial or financial information, or information about a consumer or other third party, for which confidential treatment is requested pursuant to the Bureau’s procedures concerning public disclosure set forth in 12 U.S.C. § 5512(c)(6)(A) and 12

C.F.R, § 1070.20 (2018).

CREDIT MONITORING AND IDENTITY THEFT PROTECTION

IT IS FURTHER ORDERED that,

A.

Defendant must, through an independent third party that will be subject to appointment and oversight by the MDL Court, offer all Affected Consumers four (4) years of a free three-bureau credit monitoring and identity theft

protection product, including $1 million in identity theft insurance and Full

Page 56

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 29 of 81

Service Identity Restoration, as described in the attached Exhibit A (the

Product’).

l. The Product shall be offered, provided, and maintained by an independent third party, and shall not be directly provided to any Affected Consumer by Defendant, Defendant’s successors or assigns, or any subsidiary, affiliate, or joint venture of Defendant. Defendant shall not receive any monetary benefit from the Product.

2. Affected Consumers may file a claim to enroll in the Product at any time during the Initial Claims Period, as described in the Claims Administration Protocol.

3, Defendant shall, through the independent third party provider of the Product, provide activation codes for enrollment in the Product to Affected Consumers who file a valid claim for the Product. Activation codes shall be sent no later than forty-five (45) days after either the Class Action Effective Date or the conclusion of the Initial Claims Period, whichever is later. An Affected Consumer shall be eligible to enroll in the Product for a period of at least ninety (90) days

following receipt of an activation code.

Page 57

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 30 of 81

To the extent the independent third party providing the Product assigns personal identification numbers (PINs) to Affected Consumers who made a claim to enroll in the Product, such PINs shall be randomized. As part of the enrollment process, Affected Consumers shall be authenticated using knowledge-based authentication questions, or other comparable authentication procedures. Authentication procedures shall be used any time an Affected Consumer requests a Consumer Report, if applicable, or to lock or unlock their Consumer Report through the Product.

As provided in Subsection X1.G.3, the period during which the

Product shall be provided to Affected Consumers may be extended.

Defendant shall also offer Affected Consumers who file valid claims and

enroll in the Product with a single-bureau credit monitoring service (“Single

Bureau Monitoring”), as described in Exhibit A.

I

Defendant shall provide such Single Bureau Monitoring upon expiration of the Product, including any extensions thereof pursuant to Subsection XI.G.3, to Affected Consumers who enroll in the Product and file valid claims for Single Bureau Monitoring. Defendant shall

provide Single Bureau Monitoring for the period of time necessary for

Page 58

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 31 of 81

the aggregate number of years of credit monitoring provided under Subsections VII.A, XI.G.3, and VII.B to equal ten (10) years.

2. Defendant shall offer Affected Consumers who were under the age of 18 as of May 13, 2017, additional years of Single Bureau Monitoring, as described in Exhibit A, necessary for the aggregate number of years of credit monitoring provided under Subsections VI.A, X1.G.3, and VII.B to equal eighteen (18) years.

For any Affected Consumer who does not make a claim to enroll in the

Product and instead has or has concurrently obtained a credit monitoring or

protection product, which he or she will have in place for a minimum of six

(6) months, such Affected Consumer may receive One Hundred Twenty-

Five Dollars ($125.00) in alternative compensation (“Alternative

Reimbursement Compensation”) by submitting a claim for Alternative

Reimbursement Compensation, as set forth in the Claims Administration

Protocol.

Defendant shall, through an independent third party that will be subject to

appointment and oversight by the MDL Court, offer all Affected Consumers,

regardless of whether they have enrolled in the Product, seven (7) years of

Page 59

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 32 of 81

free identity restoration services, with the features described in Exhibit A

(“Assisted Identity Restoration”).

l. Assisted Identity Restoration shall be offered, provided, and maintained by the independent third party that has been approved by a representative of the Bureau and that will be presented to the MDL Court for approval. Assisted Identity Restoration Services shall not be directly provided to any Affected Consumer by Defendant, Defendant’s successors or assigns, or any subsidiary, affiliate, or joint venture of Defendant. Defendant shall not receive any monetary benefit from Assisted Identity Restoration.

De Any Affected Consumer may avail himself or herself of the free Assisted Identity Restoration, as described in Exhibit A, for seven (7) years from the Class Action Effective Date regardless of whether that Affected Consumer filed a claim to enroll in the Product during the Initial Claims Period.

Defendant shall provide all consumers, regardless of whether they are

Affected Consumers, with an easily accessible process to place or remove

security freezes or locks on their Personal Consumer Reports for free and

Page 60

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 33 of 81

without filing a claim for ten (10) years from either (1) the Effective Date of

this Order or (2) the Class Action Effective Date, whichever shall occur first.

iF Defendant shall randomize PINs to Affected Consumers requesting a Personal Consumer Report, or lock or security freeze of a Personal Consumer Report.

2. Defendant, and all other persons acting at Defendant’s direction, shall not dissuade or seek to dissuade Affected Consumers from placing or choosing to place a security freeze. Should Defendant offer any standalone product or service as an alternative with substantially similar features as a security freeze, Defendant shall not seek to persuade Affected Consumers to choose the alternative product or service instead of a security freeze.

Defendant shall, for a period of seven (7) years beginning no later than

December 31, 2019, provide to all U.S. consumers a clearly accessible

process to obtain six (6) free copies during any 12-month period of their

Personal Consumer Report, in addition to any free reports to which

consumers are entitled under federal law, updated as of the time of request.

Defendant shall, for a period of ten (10) years from the Effective Date of this

Order, develop and implement dispute handling procedures, including

Page 61

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 34 of 81

escalation to agents specially trained in fraud and a sufficient number of call center representatives to handle reasonably expected call volumes, for Affected Consumers who assert that information on their Personal Consumer

Reports is inaccurate as a result of identity theft or fraud.

VIII. PROHIBITION ON ADVERTISING OR MARKETING TO CONSUMERS WHO USE IDENTITY PROTECTION SERVICES

IT IS FURTHER ORDERED that Defendant, Defendants’ officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, shall not use any information provided by Affected Consumers (or the fact that the consumer provided information) to enroll in or use, the Product, the Single Bureau Monitoring, the Full Service or Assisted Identity Restoration set forth in Section VIL and Exhibit A, or the free credit monitoring products offered by Defendant in connection with the Breach—Equifax TrustedID Premier, Equifax Credit Watch Gold with 3 in 1 Monitoring, or Experian IDNotify—to sell, upsell, cross-sell, or directly market or advertise its products or services, unless Defendant first obtains

and documents the consumer’s affirmative express consent.

Page 62

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 35 of 81

IX. CONSUMER FUND IT IS FURTHER ORDERED that:

Equifax Inc., its successors and assigns, must deposit the amounts specified in Section XI.B below into the Consumer Fund for the purpose of providing restitution and redress to Affected Consumers, as required by this Section. All applicable taxes, duties, and similar charges due from the Consumer Fund shall be paid from the interest earned on the Consumer Fund. Pursuant to Section XI, and as set forth in the Claims Administration Protocol, the Consumer Fund shall be used to pay or fund the following:

1. The cost of providing the Product, including Full Service Identity Restoration, as described in Subsection VII.A and Exhibit A, subject to the requirements of Subsection XIE;

Z. The cost of providing Assisted Identity Restoration, as described in Subsection VILD and Exhibit A;

3. Reimbursements to Affected Consumers who file valid claims for Alternative Reimbursement Compensation, as described in Subsection VILC;

4, Reimbursements to Affected Consumers who file valid claims for

Out-of-Pocket Losses;

Page 63

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 36 of 81

5. Costs and expenses of the Settlement Administrator, including but not limited to processing claims;

6. Costs and expenses of the Notice Provider, including but not limited to implementing and providing notice to Affected Consumers pursuant to the Notice Plan; and

i Service awards, if any, to the Affected Consumers named as plaintiffs in the Multi-District Litigation in the amount approved by the MDL Court.

a. Such service awards are not being ordered by the Bureau.

Nonetheless, the Bureau does not object to up to Two Hundred Fifty Thousand Dollars ($250,000) from the Consumer Fund being used to pay service awards to the named plaintiffs in the Multi-District Litigation. To the extent the MDL Court approves service awards in excess of $250,000, such amounts shall not be paid from the funds deposited into the Consumer Fund pursuant to Section XLB and shall be paid solely by the Defendant.

C. Subject to Subsection X1.G, payments from the Consumer Fund shall be

subject to the following limitations:

Page 64

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 37 of 81

lL. Any Affected Consumer may request the restitution and redress described in this Section as follows:

a. During the Initial Claims Period, Affected Consumers may file claims for (1) the Product, (2) Single Bureau Monitoring,

(3) Alternative Reimbursement Compensation, and

(4) reimbursement of Out-of-Pocket Losses;

b. During the Extended Claims Period, Affected Consumers may file claims for reimbursement for the following Out-of-Pocket Losses incurred during the Extended Claims Period, only if the Affected Consumer provides a certification that he or she has not obtained reimbursement for the claimed expense through other means:

(i) | Unreimbursed costs, expenses, losses, or charges incurred by an Affected Consumer as a result of identity theft or identity fraud, falsified tax returns, or other alleged misuse of an Affected Consumer’s Personal Information;

(ii) | Time Compensation to an Affected Consumer, limited to

time spent remedying fraud, identity theft, or other

Page 65

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 38 of 81

misuse of an Affected Consumer’s Personal Information that is fairly traceable to the Breach; and (iii) Other miscellaneous expenses, incurred by an Affected Consumer related to remedying fraud, identity theft, or other misuse of an Affected Consumer’ s Personal Information, such as notary, fax, postage, copying, mileage, and long-distance telephone charges. a An Affected Consumer may obtain up to an aggregate maximum amount of $20,000 in Out-of-Pocket Losses. . Time Compensation, a subcategory of Out-of-Pocket Losses, shall be subject to the following provisions:

a. Affected Consumers who spent or spend time (1) taking Preventative Measures or (2) remedying fraud, identity theft, or other alleged misuse of the Affected Consumer’s Personal Information fairly traceable to the Breach may seek reimbursement for their time.

b. Subject to Subsection [X.C.5, Time Compensation shall be

paid at a rate of $25 per hour, reimbursable in 15-minute

Page 66

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 39 of 81

increments, with a minimum reimbursement of | hour per valid claim for Time Compensation.

c. Affected Consumers may submit a claim for up to 10 hours of Time Compensation, provided they certify (i) to taking Preventative Measures and/or remedying fraud, identity theft, or other alleged misuse of the Affected Consumer’ s Personal Information fairly traceable to the Breach, and (ii) an explanation of the time they spent taking Preventative Measures or remedying fraud, identity theft, or other alleged misuse of their Personal Information.

d. Affected Consumers may submit a claim for up to 20 hours of Time Compensation, provided they spent time remedying fraud, identity theft, or other alleged misuse of the Affected Consumer’s Personal Information fairly traceable to the Breach, and provide (i) reasonable documentation (as defined in the Claims Administration Protocol) of the fraud, identity theft, or other alleged misuse of the Affected Consumer’s

Personal Information fairly traceable to the Breach and

Page 67

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 40 of 81

(ii) describe the time spent remedying these issues or time spent taking Preventative Measures in response to these issues. 4. No more than Thirty-One Million Dollars ($31,000,000) shall be paid as Alternative Reimbursement Compensation for valid claims filed during the Initial Claims Period (the “Alternative Reimbursement Compensation Cap”). To the extent valid claims for Alternative Reimbursement Compensation made during the Initial Claims Period exceed the Alternative Reimbursement Compensation Cap, payments for such valid claims shall be reduced on a pro rata basis. At the conclusion of the Extended Claims Period, after all payments required by Subsection IX.B have been made, if there are remaining unused funds in the Consumer Fund, the Alternative Reimbursement Compensation Cap shall be lifted, and payments to Affected Consumers who filed valid claims for Alternative Reimbursement Compensation shall be increased on a pro rata basis, up to the full amount of the valid claim, as set forth in Section X1.G.1 below. 5: No more than Thirty-One Million Dollars ($31,000,000) shall be paid as Time Compensation for valid Time Compensation claims made

during the Initial Claims Period (the “Initial Time Compensation

Page 68

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 41 of 81

Cap”). To the extent valid claims for Time Compensation made during the Initial Claims Period exceed the Initial Time Compensation Cap, payments for such valid claims shall be reduced on a pro rata basis. Valid claims for Time Compensation made during the Extended Claims Period shall be paid in the order they are received and approved at the same pro rata rate (if applicable) as valid Time Compensation claims made during the Initial Claims Period. No more than Thirty-Eight Million Dollars ($38,000,000) in the aggregate shall be paid as Time Compensation for valid claims made during both the Initial Claims Period and Extended Claims Period (“Aggregate Time Compensation Cap”). At the conclusion of the Extended Claims Period, after payment of valid claims made during the Extended Claims Period, to the extent there are remaining unused funds in the Consumer Fund, the Aggregate Time Compensation Cap shall be lifted, and payments to all Affected Consumers who filed valid claims for Time Compensation shall be increased on a pro rata basis, up to the full amount of the valid claim, as set forth in Section X1.G,1

below.

4]

Page 69

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 42 of 81

X. NOTICE AND CLAIMS ADMINISTRATION IT IS FURTHER ORDERED, that

The Notice Plan: Notice to Affected Consumers shall be provided pursuant to the Notice Plan. Defendant shall supply the Notice Provider with information in its possession, custody, or control, to the extent reasonably available, regarding the Affected Consumers to enable the Notice Provider to implement the Notice Plan.

The Claims Administration Protocol: Restitution and redress to Affected Consumers shall be administered from the Consumer Fund consistent with the Claims Administration Protocol. Defendant shall supply the Settlement Administrator with information in its possession, custody, or control, to the extent reasonably available, regarding the Affected Consumers to enable the Settlement Administrator to implement and administer the Claims Administration Protocol.

Defendant must notify the Bureau of any requested modifications to the Notice Plan or Claims Administration Protocol, including any change of the Notice Provider or Settlement Administrator, and any such modification

requested by the Defendant must be approved by a designated representative

Page 70

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 43 of 81

of the Bureau, with such approval not unreasonably withheld, and shall also

require approval from the MDL Court.

In connection with the administration of the Consumer Fund overseen by the

MDL Court:

l.

The Bureau may send a request for information regarding compliance with the Notice Plan, the claims process, and proper administration of the Consumer Fund, and any request will include all parties to the Class Action Settlement and the Commission. Discussion and fulfillment of responses to a request from the Bureau will be made consistent with the Claims Administration Protocol;

The Defendant shall provide to the Bureau the weekly reports prepared by the Settlement Administrator pursuant to the Multi- District Litigation that summarize information related to claims administration;

The Defendant shall provide to the Bureau copies of any reports submitted to the Federal Trade Commission under the FTC Order; and The information provided to the Bureau described in this Section X.D shall be treated as confidential pursuant to 12 C.F.R. $1070 (2018)

until at least the Class Action Effective Date.

Page 71

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 44 of 81

Following the Class Action Effective Date, upon written request by the

Bureau, Defendant shall provide the following information, if available, in

accordance with instructions provided by a representative of the Bureau to

Defendant.

1.

The number of unique clicks on the hyperlink for the Settlement Website from the homepage of Defendant’s primary, consumer-facing website, www.equifax.com;

The number of unique clicks on the hyperlink for the Settlement Website from Defendant’s incident website, www.equifaxsecurity2017.com;

The number of viewers who reached the Settlement Website through the notice methods as described in the Notice Plan, where such information can be obtained, including via email communication; The number of Affected Consumers who filed a claim to enroll in the Product;

The number of Affected Consumers who completed enrollment in the

Product;

Page 72

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 45 of 81

10.

id,

The number and total dollar amount of claims filed by Affected Consumers under the identity theft insurance provided pursuant to the Product, and the total dollar figure and percentage of claims paid;

The number of Affected Consumers who filed a claim to enroll in the Single Bureau Monitoring;

The number of Affected Consumers who completed enrollment in the Single Bureau Monitoring;

The number of Affected Consumers who availed themselves of the Full Service Identity Restoration and Assisted Identity Restoration; The number of Affected Consumers who filed claims for Out-of- Pocket Losses; the total amounts claimed for each subcategory of Outof-Pocket Losses; the total amount disbursed from the Consumer Fund for each subcategory of Out-of-Pocket Losses, and the average number of days between the date of the claim and the date of disbursement;

The number of Affected Consumers who filed claims for Alternative Reimbursement Compensation; the total dollar amount of claims filed for Alternative Reimbursement Compensation; the total amount

disbursed from the Consumer Fund for Alternative Reimbursement

Page 73

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 46 of 81

12.

13.

Compensation; and the average number of days between the date of the claim and the date of disbursement;

The number of consumer complaints received by the Settlement Administrator or the third party providing the Product, regarding

(a) access to the Settlement Website, (b) enrollment in the Product, (c) the Product components, (d) identity theft, and (e) other complaints received by the Settlement Administrator relating to the provision of restitution and redress through the Consumer Fund, including the claims process. Defendant shall develop and implement a process to direct consumers that contact Defendant with issues related to the Class Action Settlement or the Consumer Fund to the Settlement Administrator and/or the Settlement Website:

The number of consumers who file a dispute or appeal with the Settlement Administrator regarding a denial of any claim; the number of appeals denied; the number of appeals approved; the average number of days between the date of the appeal and the appeal decision; and the average number of days between the appeal decision

and disbursement, if applicable; and

Page 74

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 47 of 81

14. Any annual reports submitted to the Federal Trade Commission pursuant to the FTC Order.

Defendant shall also take the following additional measures to notify

Affected Consumers of their ability to enroll in the Product and obtain the

restitution and redress set forth in this Order using terms consistent with the

approved Notice Plan by, no later than:

1, One day after filing of this Order:

a. Posting a hyperlink to the Settlement Website on the top portion of the landing page for Defendant's primary, consumerfacing website, www.equifax.com, which shall state “Visit www.EquifaxBreachSettlement.com for information on the Equifax Data Breach Settlement” or “Equifax Data Breach Settlement,” until the expiration of the Initial Claims Period; and

b. Posting a hyperlink to the Settlement Website on Defendant’ s incident website, www.equifaxsecurity2017.com, which shall state “Visit www.EquifaxBreachSettlement.com for

information on the Equifax Data Breach Settlement” or

4]

Page 75

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 48 of 81

“Equifax Data Breach Settlement,” until the expiration of the Extended Claims Period.

2. Seven (7) days of entry of an order permitting issuance of notice of the Class Action Settlement:

a. Issuing a press release, including a hyperlink to www.EquifaxBreachSettlement.com with information about the Product, the Consumer Fund, and the Settlement Website:

b, Posting a monthly Twitter notification via Defendant’s primary Twitter account, the text of which shall read “Visit www.EquifaxBreachSettlement.com for information on the Equifax Data Breach Settlement” until the expiration of the Initial Claims Period, and biannually thereafter until the expiration of the Extended Claims Period; and

C. Posting a monthly Facebook notification via Defendant's primary Facebook account, the text of which shall read “Visit www.EquifaxBreachSettlement.com for information on the Equifax Data Breach Settlement” until the expiration of the Initial Claims Period, and biannually thereafter until the

expiration of the Extended Claims Period.

Page 76

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 49 of 81

To U.S. Consumers, issuing a press release seven (7) days after the relief described in Section VII.F becomes available, with information about the availability of six free copies of a U.S. consumer’ s Personal Consumer Report during any twelve-month period for seven years, including a hyperlink to the webpage where consumers can request

free Personal Consumer Reports.

XI. MONETARY JUDGMENT

IT IS FURTHER ORDERED that:

Judgment in the amount of Four Hundred Twenty-Five Million Dollars

($425,000,000) is entered in favor of the Bureau against Defendant for the

purpose of providing restitution and redress to Affected Consumers.

Equifax Inc., its successors and assigns, shall pay this judgment as follows;

1.

No later than fifteen (15) days following the date this Order is filed, Equifax Inc. shall deposit into the Consumer Fund One Hundred Fifty Thousand Dollars ($150,000) to cover reasonable set-up costs of the Notice Provider;

No later than fifteen (15) days after the MDL Court enters an order permitting issuance of notice of class action settlement for the Class

Action Settlement, Equifax Inc., its successors and assigns, shall

Page 77

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 50 of 81

deposit into the Consumer Fund Twenty-Five Million Dollars ($25,000,000) to cover reasonable costs and expenses of the Settlement Administrator and Notice Provider and set-up costs for the independent third-party providing the Product and Assisted Identity Restoration;

3: No later than fifteen (15) days following the Class Action Effective Date, Equifax Inc., its successors and assigns, shall deposit Three Hundred Million Dollars ($300,000,000) into the Consumer Fund, less any amounts paid pursuant to Sections XI.B.1 and X1.B.2, to be used for the purposes set forth in Sections VII and IX; and

4, Equifax Inc., its successors and assigns, shall make all payments into the Consumer Fund as required by Section X1.C, up toa maximum of One Hundred Twenty-Five Million Dollars ($125,000,000).

If at any time during the Initial Claims Period or the Extended Claims

Period, there are insufficient funds in the Consumer Fund (or, if it has

received a written notice of a Triggering Event as described below in

Subsection XLI, a fund administered by the Federal Trade Commission or its

designee on behalf of the Federal Trade Commission, the Bureau, and the

States’ Attorneys’ General) to pay valid claims pursuant to Section IX (a

Page 78

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 51 of 81

“Shortfall”), Equifax Inc., its successors and assigns, shall make additional payments into the Consumer Fund of up to One Hundred Twenty-Five Million Dollars ($125,000,000) for the purpose of paying Out-of-Pocket Losses.

Defendant shall notify the Enforcement Director within three (3) business days of when the Settlement Administrator notifies Defendant of a Shortfall, as set forth in the Claims Administration Protocol. This notification shall identify the amount needed to pay the Shortfall. Within fourteen (14) days of receiving written notice from the Settlement Administrator of a Shortfall, Equifax Inc., its successors and assigns, shall deposit money into the Consumer Fund in the amount necessary to cure the Shortfall.

Equifax Inc., its successors and assigns, is ordered to pay into the Consumer Fund (or, if it has received a written notice of a Triggering Event as described below in Subsection XI.I, a fund administered by the Federal Trade Commission or its designee on behalf of the Federal Trade Commission, the Bureau, and the States’ Attorneys’ General) additional amounts for purposes of providing restitution and redress to Affected

Consumers, as follows:

5]

Page 79

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 52 of 81

l. If, at the end of the Initial Claims Period, more than 7 million

Affected Consumers have enrolled in the Product, the following

obligations apply:

a.

If the total payments required under Subsections IX.B.2-7 and the cost of providing the Product to 7 million Affected Consumers (the “Costs”) are greater than or equal to Three Hundred Million Dollars ($300,000,000), Equifax Inc., its successors and assigns, shall pay into the Consumer Fund an amount equal to the cost of providing the Product to enrollees above 7 million (the “Additional Credit Monitoring Cost”);

If the Costs are less than $256,500,000 and the Additional Credit Monitoring Cost is greater than $43,500,000, Equifax Inc., its successors and assigns, shall pay into the Consumer Fund an amount equal to the Additional Credit Monitoring Cost less $43,500,000; and

If (i) the Costs are greater than or equal to $256,500,000, but less than $300,000,000 and (ii) the Costs plus the Additional Credit Monitoring Costs are greater than $300,000,000, Equifax

Inc., its successors and assigns, shall pay into the Consumer

Page 80

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 53 of 81

Fund an amount equal to the Costs plus Additional Credit

Monitoring Costs less $300,000,000.

NM

If, during the Extended Claims Period, more than 7 million Affected Consumers have enrolled in the Product and either (i) the Costs are greater than or equal to $256,500,000 or (ii) the Additional Credit Monitoring Costs are greater than or equal to $43,500,000 then, on a monthly basis, Equifax Inc., its successors and assigns shall deposit any additional money into the Consumer Fund that would be required pursuant to the calculations in Subsection X1.E.1.a-c, less any amounts previously deposited pursuant to Subsection XLE.1 or previously under this subsection.

An amount no less than $300 million, plus any amount deposited in the Consumer Fund pursuant to Subsections XI.C and XIE, including all accumulated interest, must be used and administered as described in Subsections VII and LX for the exclusive benefit of Affected Consumers. At the conclusion of the Extended Claims Period, the Settlement Administrator shall distribute or use any remaining funds as follows:

l. First, the Aggregate Time Compensation Cap and Alternative

Reimbursement Compensation Cap, as described in Subsections

Page 81

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 54 of 81

IX.C.4-5, shall both be lifted (if applicable) and payments increased pro rata to Affected Consumers who submitted valid claims for Time Compensations and/or Alternative Reimbursement Compensation up to the full amounts of those claims; then

5 Second, to provide Assisted Identity Restoration to all Affected Consumers for up to an additional thirty-six (36) months in full-month increments; then

3. Third, to extend the duration of the Product to Affected Consumers enrolled in the Product until the funds in the Consumer Fund are exhausted.

The money deposited into the Consumer Fund and all accumulated interest

shall be administered by the Settlement Administrator consistent with the

Claims Administration Protocol.

If any of the following events (“Triggering Events”) should occur, the

Bureau and the Federal Trade Commission may, in their sole discretion,

jointly send Defendant a written notice of a Triggering Event:

1, A settlement agreement releasing settlement class action member claims in the Multi-District Litigation and a motion for an order

permitting issuance of notice of the Class Action Settlement

Page 82

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 55 of 81

containing terms materially similar to those outlined in Sections VI, LX, X, and XI, and Exhibit A of this Order, is not submitted to the MDL Court within fourteen (14) days after the filing of this Order, provided however that the Defendant, the Bureau, or the Federal Trade Commission are not the cause of such failure;

2. The MDL Court declines to enter an order permitting issuance of notice of class action settlement for a settlement agreement releasing settlement class member claims in the Multi-District Litigation with terms materially similar to those outlined in Sections VII, [X, X, and XI, and Exhibit A of this Order and either (i) a modified settlement agreement releasing settlement class member claims is not submitted to the MDL Court within sixty (60) days; or (ii) a modified settlement agreement releasing settlement class member claims is submitted to the MDL Court without Defendant first obtaining approval from a representative of the Bureau, which approval shall not be unreasonably withheld, shall not be refused if the proposed modification is no less favorable to Affected Consumers than the

terms of this Order, and shall be timely provided;

Page 83

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 56 of 81

3. The MDL Court declines to enter a Final Approval Order for a settlement agreement releasing settlement class member claims in the Multi-District Litigation with terms materially similar to those outlined in Sections VII, IX, X, and XI, and Exhibit A of this Order and either (i) a modified settlement agreement releasing settlement class member claims is not submitted to the MDL Court within sixty (60) days; or (ii) a modified settlement agreement releasing settlement class member claims is submitted to the MDL Court without Defendant first obtaining approval from a representative of the Bureau, which approval shall not be unreasonably withheld, shall not be refused if the proposed modification is no less favorable to Affected Consumers than the terms of this Order, and shall be timely provided;

4. The MDL Court’s Final Approval Order is overturned on appeal and either (i) a modified settlement agreement releasing settlement class member claims is not submitted to the MDL Court within sixty (60) days; or (ii) a modified settlement agreement releasing settlement class member claims in the Multi-District Litigation is submitted to

the MDL Court without Defendant first obtaining approval from a

Page 84

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 57 of 81

representative of the Bureau, which approval shall not be unreasonably withheld, shall not be refused if the proposed modification is no less favorable to Affected Consumers than the terms of this Order, and shall be timely provided; and

5. The MDL Court approves a modified settlement agreement other than the one approved by the Bureau releasing settlement class member claims in the Multi-District Litigation that interferes in any way with the Bureau’s ability to enforce this Order.

J. If one of the events described in Subsection XI.1.2-4 occurs as a result of an objection filed by the Bureau, the Commission, or the States’ Attorneys General in the MDL Court to either the Class Action Settlement or a modified settlement agreement releasing settlement class member claims in the Multi-District Litigation and such Class Action Settlement or modified settlement agreement contains terms materially similar to Sections VII, IX, X, and XI, and Exhibit A, such event shall not constitute a Triggering Event. If the Commission and the Bureau jointly send Defendant a written notice of a Triggering Event, Sections X1.I-L of this Order will not be construed in a

way that interferes with the Multi-District Litigation.

Page 85

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 58 of 81

Any modified settlement agreement submitted to the MDL Court pursuant to Subsections XI.L.2-4 shall contain terms that provide no less relief to Affected Consumers than set forth in this Order. If Defendant fails to comply with Subsections X1.B.1, X1.B.2, XI.B.3, or X1.B.4, and receives written notice of such failure, or if the Bureau and Federal Trade Commission send Defendant a written notice of a Triggering Event pursuant to XI.J, then the Bureau may move to enforce this Order. Defendant waives any objections to the Bureau’s motion to enforce the Order under the circumstances described in this paragraph. All other provisions of this Order shall remain in full force and effect, and the Bureau and Commission shall jointly notify Defendant in writing that the Notice Plan (to the extent it has not already been administered) and the Claims Administration Protocol will be administered under the supervision of the Federal Trade Commission on behalf of the Bureau, the Federal Trade Commission, and the States’ Attorneys General pursuant to Section XI of the FTC Order.

If Defendant fails to comply with Subsections XI1.B.1, X1.B.2, X1.B.3, or X1LB.4, and receives a written notice of such failure, or Defendant receives a

written notice of a Triggering Event as further described in Subsection X11,

Page 86

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 59 of 81

then Equifax Inc., its successors and assigns, shall pay the judgment as

follows:

L

Within twenty one (21) days, deposit $300,000,000 plus any interest accumulated in the Consumer Fund attributed to any payment required pursuant to Section XI.B, less any payments that have already been disbursed by the Settlement Administrator, into a fund administered by the Federal Trade Commission or its designee on behalf of the Federal Trade Commission, the Bureau, and States’ Attorneys’ General to be used for consumer restitution and redress as set forth in this Order;

Make all payments required by Subsection XI.C up to a maximum of One Hundred Twenty-Five Million Dollars ($125,000,000) into such fund; and

Make all payments required by Subsection X1L.E into such fund.

Xl. CIVIL MONEY PENALTIES

IT IS FURTHER ORDERED that:

Under section 1055(c) of the CFPA, 12 U.S.C. § 5565(c), by reason of the

violations of law described in the Complaint, and taking into account the

factors in 12 U.S.C. § 5565(c)(3), Equifax Inc., its successors and assigns,

Page 87

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 60 of 81

must pay a civil money penalty of One Hundred Million Dollars

($100,000,000) to the Bureau (“Civil Money Penalty”). The penalty paid

under this Order will be deposited in the Civil Penalty Fund of the Bureau as

required by section 1017(d) of the CFPA, 12 U.S.C. § 5497(d).

Within 30 days of the Effective Date of this Order, Equifax Inc., its

successors and assigns, must pay the civil money penalty by wire transfer to

the Bureau or to the Bureau's agent in compliance with the Bureau's wiring

instructions.

Defendant must treat the penalty paid under this Order as a penalty paid to

the government for all purposes. Regardless of how the Bureau ultimately

uses those funds, Defendant may not:

L; Claim, assert, or apply for a tax deduction, tax credit, or any other tax benefit for the penalty paid under this Order; or

2. Seek or accept, directly or indirectly, reimbursement or indemnification from any source, including but not limited to payment made under any insurance policy, with regard to the penalty paid under this Order.

To preserve the deterrent effect of the penalty in any Related Consumer

Action, Defendant may not argue that Defendant is entitled to, nor may

Page 88

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 61 of 81

Defendant benefit by, any offset or reduction of any compensatory monetary remedies imposed in any Related Consumer Action because of the penalty paid in this action. If the court in any Related Consumer Action offsets or otherwise reduces the amount of compensatory monetary remedies imposed against Defendant based on the penalty paid in this action or based on any payment that the Bureau makes from the Civil Penalty Fund, Defendant must, within 30 days after entry of a final order granting such offset or reduction, notify the Bureau, and pay the amount of the offset or reduction to the U.S. Treasury. Such a payment will not be considered an additional civil money penalty and will not change the amount of the civil money penalty

imposed in this action.

XI. ADDITIONAL MONETARY PROVISIONS IT IS FURTHER ORDERED that:

In the event of any default on Defendant’s obligations to make payment under this Order, interest computed under 28 U.S.C. § 1961, as amended, will accrue on any outstanding amounts not paid from the date of default to the date of payment, and will immediately become due and payable. Defendant relinquishes dominion and all legal and equitable right, title, and

interest in all assets transferred pursuant to this Order and may not seek the

Page 89

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 62 of 81

return of any assets, except in the event of a Triggering Event. In that instance, Defendant shall have the right to seek the return of assets deposited into the Fund that have not been disbursed by the Settlement Administrator so that Defendant may provide such assets to the Federal Trade Commission to begin disbursing funds from the Consumer Fund and performing, pursuant to Subsections XI.K-L, all duties and obligations under this Order. The facts alleged in the Complaint will be taken as true, without further proof, in any subsequent civil litigation by or on behalf of the Bureau in a proceeding to enforce its rights to any payment or monetary judgment pursuant to this Order, such as a nondischargeability complaint in any bankruptcy case.

The facts alleged in the Complaint establish all elements necessary to sustain an action by the Bureau pursuant to Section 523(a)(2)(A) of the Bankruptcy Code, 11 U.S.C. § 523(a)(2)(A), and this Order will have collateral estoppel effect for such purposes.

Defendant acknowledges that its Taxpayer Identification Number, which Defendant must submit to the Bureau, may be used for collecting and reporting on any delinquent amount arising out of this Order, in accordance

with 31 U.S.C. § 7701.

Page 90

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 63 of 81

On an annual basis for twenty (20) years following the Effective Date of this Order, Defendant must provide the Enforcement Director in writing with the total number of final judgments, consent orders, or settlements in Related Consumer Actions during the preceding year, as well as the total amount of redress, if any, that Defendant paid or was required to pay to consumers pursuant to those Related Consumer Actions, and describe the consumers or

classes of consumers to whom that redress, if any, has been or will be paid.

XIV. ORDER ACKNOWLEDGMENTS IT IS FURTHER ORDERED that Defendant obtain acknowledgments of

receipt of this Order:

A.

Defendant, within seven (7) days of entry of this Order, must submit to the Bureau an acknowledgment of receipt of this Order sworn under penalty of perjury.

Within 30 days of the Effective Date, Defendant must deliver a copy of this Order to all (1) principals, officers, directors, and LLC managers and members, and (2) all employees, managers, agents, representatives, and service providers having managerial or supervisory responsibilities for conduct related to the subject matter of the Order. For ten (10) years from

the Effective Date, Defendant must deliver a copy of this Order to: (1) any

Page 91

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 64 of 81

business entity resulting from any change in structure as set forth in Section XV; (2) all future board members and executive officers; and (3) all employees, managers, agents, representatives, and service providers having managerial or supervisory responsibilities for conduct related to the subject matter of the Order before the date on which they assume their responsibilities.

C. From each individual or entity to which Defendant delivered a copy of this Order, Defendant must obtain, within 30 days, a signed and dated acknowledgment of receipt of this Order, ensuring that any electronic signatures conform with the requirements of the E-Sign Act, 15 U.S.C.

§ 7001 et seq.

XV. COMPLIANCE REPORTING IT IS FURTHER ORDERED that Defendant make timely submissions to

the Bureau:

A. Within seven (7) days after the entry of this Order, Defendant must identify the primary physical, postal, and email address and telephone number, as designated points of contact, which representatives of the Bureau may use to

communicate with Defendant.

Page 92

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 65 of 81

One year after entry of this Order, Defendant must submit a compliance report, sworn under penalty of perjury, in which Defendant must: (a) identify the primary physical, postal, and email address and telephone number, as designated points of contact, which representatives of the Bureau may use to communicate with Defendant; (b) identify all of Defendant’s businesses by all of their names, telephone numbers, and physical, postal, email, and Internet addresses; (c) describe the activities of each business identified

in (b), including the goods or services offered, the means of advertising, marketing, and sales, and the categories or types of Personal Information collected, transferred, maintained, processed or stored by each business;

(d) describe in detail whether and how Defendant is in compliance with each Section of this Order; and (e) provide a copy of, or record proving, each Order Acknowledgment obtained pursuant to this Order, unless previously submitted to the Bureau.

For twenty (20) years after entry of this Order, Defendant must submit a compliance notice, sworn under penalty of perjury, within 14 days of any change in the following: (a) any designated point of contact, or (b) the structure of any entity that Defendant has any ownership interest in or

controls directly or indirectly that may affect compliance obligations arising

Page 93

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 66 of 81

under this Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or practices subject to this Order.

Defendant must submit to the Bureau notice of the filing of any bankruptcy petition, insolvency proceeding, or similar proceeding by or against the Defendant within fourteen (14) days of its filing.

Any submission to the Bureau required by this Order to be sworn under penalty of perjury must be true and accurate and comply with 28 U.S.C.

§ 1746, such as by concluding: “I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on; ____” and supplying the date, signatory’s full name, title (if applicable), and signature.

Unless otherwise directed by a Bureau representative in writing, all submissions to the Bureau pursuant to this Order must be emailed to Enforcement_Compliance @cfpb.gov and sent by overnight courier or first class mail to Enforcement Director, Bureau of Consumer Financial Protection, 1700 G Street NW, Washington, DC 20552. The subject line must begin “Bureau of Consumer Financial Protection vy. Equifax Inc.,

BCFP File No. 2017-1906-02.”

Page 94

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 67 of 81

XVI. RECORDKEEPING IT IS FURTHER ORDERED that Defendant must create certain records

for twenty (20) years after entry of the Order, and retain each such record for five

(5) years. Specifically, Defendant must create and retain the following records:

A.

B.

Accounting records showing the revenues from all goods or services sold; Personnel records showing, for each person providing services, whether as an employee or otherwise, that person’s: name; addresses; telephone numbers; job title or position; dates of service; and (if applicable) the reasons for termination;

Copies of records of all U.S. consumer complaints concerning the subject matter of the Order, whether received directly or indirectly, such as through a third party, and any response;

Copies of final judgments, consent orders, or settlements in Related Consumer Actions;

A copy of each information security assessment required by this Order and any material evaluations of Defendant's physical, technical, or administrative controls to protect the confidentiality, integrity, or availability

of Personal Information;

Page 95

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 68 of 81

F. A copy of each widely disseminated and unique representation by Defendant that describes the extent to which Defendant maintains or protects the privacy, confidentiality, security, or integrity of any Personal Information;

G. For five (5) years after the date of preparation of each Assessment required by this Order, all materials and evidence that are in Defendant’s possession and control that the Assessor considered, reviewed, relied upon or examined to prepare the Assessment, whether prepared by or on behalf of Defendant, including all plans, reports, studies, reviews, audits, audit trails, policies, training materials, and assessments, and any other materials concerning Defendant’s compliance with related Sections of this Order, for the compliance period covered by such Assessment, and

H. All records necessary to demonstrate full compliance with each Section of

this Order; including all submissions to the Bureau.

XVI. COMPLIANCE MONITORING IT IS FURTHER ORDERED that, for the purpose of monitoring

Defendant’s compliance with this Order:

A. Within fourteen (14) days of receipt of a written request from a representative of the Bureau, Defendant must: submit additional compliance

reports or other requested information, related to the requirements of this

Page 96

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 69 of 81

Order, which must be sworn under penalty of perjury; provide sworn testimony and appear for depositions; and produce documents related to the cequirements of this Order and Defendant’s compliance with those requirements, for inspection and copying. The Bureau is also authorized to obtain discovery, without further leave of court, using any of the procedures prescribed by Federal Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 34, 36, 45, and 69.

For matters concerning this Order, the Bureau is authorized to communicate directly with Defendant. Defendant must permit representatives of the Bureau to interview any employee or other person affiliated with Defendant who has agreed to such an interview. The person interviewed may have counsel present.

The Bureau may use all other lawful means, including posing, through its representatives, as consumers, suppliers, or other individuals or entities, to Defendant or any individual or entity affiliated with Defendant, without the necessity of identification or prior notice. Nothing in this Order limits the Bureau’s lawful use of civil investigative demands under 12. C.F.R.

§ 1080.6 (2018) or other compulsory process.

Page 97

XVIII.

SEVERABILITY IT IS FURTHER ORDERED that if any clause, provision, or section of this Order shall, for any reason, be held illegal, invalid, or unenforceable, such illegality, invalidity or unenforceability shall not affect any other clause, provision or section of this Order and this Order shall be construed and enforced as if such illegal, invalid or unenforceable clause, section or provision had not been contained herein.

XIX.

RETENTION OF JURISDICTION IT IS FUTHER ORDERED that this Court retains jurisdiction of this matter for purposes of construction, modification, and enforcement of this Order. SO ORDERED this ;( 3 day of ~ , 2019.

~In<' .:?A:a-~ Judge Thomas \V. Thrash, Jr.

United States District Court Chief Judge Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 70 of 81

Page 98

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 71 of 81

LOCAL COUNSEL: FOR PLAINTIFF:

BUREAU OF CONSUMER BYUNG J. PAK FINANCIAL PROTECTION United States Atto et ee ' CARA PETERSEN AKASH DES re Acting Enforcement Director Assistant U.S. Attorney Georgia Bar No. 338124 rhe hohcrees - 600 US. Courthouse eputy Enforcement Director 75 Ted Turner Drive SW —

Atlanta, Georgia 30303 ~ ff NL ie Telephone: 404-581-6364 AENELLE M. DENNIS Facsimile: 404-581-6181 D.C. Bar No. 494958

RICHA DASGUPTA

D.C. Bar No. 500509

P. SOLANGE HILFINGER-PARDO California Bar No. 320055

EMILY MINTZ SACHS

Virginia Bar No. 82437

Bureau of Consumer Financial Protection 1700 G Street, NW

Washington, DC 20552

Telephone: (202) 435-9118 (Dennis) Facsimile: (202) 425-7722

Email: [email protected]

Page 99

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 72 of 81

FOR DEFENDANT:

JOHN J.

Corporate Vice President, C Officer

Equifax Inc.

1550 Peachtree Street, NW Atlanta, GA 30309

Date:_ Z/12//? t / e Ul

Legal

Shacks

EDITH RAMIREZ HARRIET PEARSON MICHELLE KISLOFF TIMOTHY TOBIN Hogan Lovells US LLP 555 Thirteenth Street, NW Washington, DC 20004 Tel: (202) 637-5600

Fax: (202) 637-5910 CL4L 14

Date:

Page 100

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 73 of 81

Page 101

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 74 of 81

Triple-Bureau Credit and Identity Monitoring Product

The following provisions are subject to the terms and definitions set forth in the

Stipulated Order for Permanent Injunctive and Monetary Judgment (the “Order’”).

The Product as defined in the Order includes:

1. Daily Consumer Report monitoring from each of the three nationwide Consumer Reporting Agencies showing key changes to one or more of an Affected Consumer’s Consumer Reports, including automated alerts when the following occur: new accounts are opened; inquiries or requests for an Affected Consumer’s Consumer Report for the purpose of obtaining credit, including for new credit card applications; changes to an Affected Consumer’s address; and negative information, including delinquencies or bankruptcies;

2. On-demand online access to a free copy of an Affected Consumer’s Experian Consumer Report, updated on a monthly basis;

3. Automated alerts, using public or proprietary data sources:

i. when data elements submitted by an Affected Consumer for monitoring, such as Social Security numbers, email addresses, or credit card numbers, appear on suspicious websites,

including websites on the “dark web;”

Page 102

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 75 of 81

ll.

ili.

iv.

Vi.

Vii.

Vill.

when names, aliases, and addresses have been associated with the Affected Consumer’s Social Security number;

when a payday loan or certain other unsecured credit has been taken or opened using the Affected Consumer’s Social Security number;

when an Affected Consumer’s information matches information in arrest records or criminal court records;

when an individual uses an Affected Consumer’s information for identity authentication;

when an Affected Consumer’s mail has been redirected through the United States Postal Service;

when banking activity is detected related to new deposit account applications, opening of new deposit accounts, changes to an Affected Consumer’s personal information on an account, and new signers being added to an Affected Consumer’s account; and

when a balance is reported on an Affected Consumer’s credit

line that has been inactive for at least six months;

4. One Million Dollars ($1,000,000) in identity theft insurance to cover

costs related to incidents of identity theft or identity fraud, with coverage

Page 103

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 76 of 81

prior to the Affected Consumer’s enrollment in the Product, provided the costs result from a stolen identity event first discovered during the policy period and subject to the terms of the insurance policy;

5. A customer service center to provide assistance with enrollment, website navigation, monitoring alerts questions, dispute assistance, fraud resolution assistance, and other assistance related to the Product;

6. Full Identity Restoration Services as described below; and

7. For Affected Consumers under the age of 18, the Product includes child monitoring services where the parent or guardian can enroll the Affected Consumer under the age of 18 to receive the following services: alerts when data elements submitted for monitoring appear on suspicious websites, such as websites on the “dark web;” alerts when the Social Security number of an Affected Consumer under the age of 18 is associated with new names or addresses or the creation of a Consumer Report at one or more of the three nationwide Consumer Reporting Agencies; and Full Service Identity Restoration, working with the legal guardian, in the event that an Affected Consumer under the age of 18 has their identity compromised. Upon turning 18, the Affected Consumer can enroll in the full Product. If an Affected Consumer under the age of

18 has an Experian Consumer Report with sufficient detail to permit

Page 104

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 77 of 81

authentication, a parent or guardian may enroll them in the full Product

prior to their eighteenth birthday.

Page 105

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 78 of 81

Identity Restoration Services

The following provisions are subject to the terms and definitions set forth in the

Stipulated Order for Permanent Injunctive and Monetary Judgment (the “Order’),

Identity Restoration Services consist of “Assisted Identity Restoration” and “Full Service Identity Restoration” provided by a third party not affiliated with Defendant.

1. Assisted Identity Restoration: Any Affected Consumer who is not

enrolled in the Product may avail themselves of Assisted Identity Restoration for seven (7) years from the Class Action Effective Date. Assisted Identity Restoration includes assignment of a dedicated identity theft restoration specialist to an Affected Consumer who has experienced an identity theft event. The specialist provides assistance to the Affected Consumer in addressing that identity theft event, including a customized step-by-step process with form letters to contact companies, government agencies, Consumer Reporting Agencies, or others, and by participating in conference calls with an affected financial institution or government

agency related to the identity theft event.

Ww

. Full Service Identity Restoration: Any Affected Consumer who is

enrolled in the Product may avail themselves of Full Service Identity

Page 106

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 79 of 81

Restoration while they are enrolled. Full Service Identity Restoration includes assignment of a dedicated identity theft restoration specialist to an Affected Consumer who has experienced an identity theft event, as well as use of a specialized limited power of attorney for the specialist to assist the Affected Consumer in addressing the identity theft event, including by contacting companies, government agencies, or Consumer Reporting Agencies on behalf of the Affected Consumer. Full Service

Identity Restoration also includes the use of interactive dispute letters.

Page 107

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 80 of 81

Equifax Single Bureau Monitoring

The following provisions are subject to the terms and definitions set forth in the

Stipulated Order for Permanent Injunctive and Monetary Judgment (the “Order’”).

Equifax Single Bureau Monitoring will include the following:

1. Daily Consumer Report monitoring from Equifax showing key changes to an Affected Consumer’s Personal Consumer Report including automated alerts when the following occur: new accounts are opened; inquiries or requests for an Affected Consumer’s Consumer Report for the purpose of obtaining credit, including for new credit card applications; changes to an Affected Consumer’s address; and negative information, such as delinquencies or bankruptcies;

2. On-demand online access to a free copy of an Affected Consumer’s Personal Consumer Report, updated on a monthly basis;

3. Automated alerts using certain available public and proprietary data sources when data elements submitted by an Affected Consumer for monitoring, such as Social Security numbers, email addresses, or credit card numbers, appear on suspicious websites, including websites on the

“dark web;” and

Page 108

Case 1:19-cv-03300-TWT Document 14 Filed 07/23/19 Page 81 of 81

4. For Affected Consumers under the age of 18, Equifax shall provide child monitoring services where the parent or guardian can enroll the Affected Consumer under the age of 18 in these services and must validate their status as guardian. Child monitoring services include: alerts when data elements such as a Social Security number submitted for monitoring appear on suspicious websites, including websites on the “dark web;” for minors who do not have a Personal Consumer Report, a Personal Consumer Report is created, locked, and then monitored; and for minors with a Personal Consumer Report, their Personal Consumer Report is locked and then monitored. The types of alerts that minors receive through child monitoring services are the same as the types of alerts that

adults receive.