Wanna Sue Equifax? Here Are All Your Options

Equifax's troubles continue to multiply. First the credit bureau, which keeps minutely detailed information about Americans' financial lives, revealed that its records had been hacked, and that it had lost key data like names, addresses and Social Security numbers for up to 143 million people -- putting them at risk for identity theft.

Then things got worse. On Monday, news broke that it had suffered a second, earlier data breach in March. On Wednesday, it came out the company had been inadvertently sending worried consumers to a phishing site.

While it's too early to tell the extent of the damages, security experts warned that an uptick in identity theft is likely to follow from Equifax's big breach. That in turn has plenty of consumers wondering: Can I take these guys to court?

Before you call your lawyer, you'll want to take a few steps to protect your own credit. After that, however, comes the question of compensation for your time and frustration -- and perhaps much more if you end up a fraud victim. Indeed, several dozen suits have been filed already on behalf of broad groups of consumers. In an email, Equifax declined to comment on pending litigation but added, "[We] want to reassure consumers that we are remaining focused on helping them to navigate this situation."

Here's all the ways consumers -- and those representing them -- are going after Equifax.

Individual Lawsuits

Indignation may make you wish you could sue Equifax on your own.

Yet individual suits would be prohibitively costly for most consumers, unless you have actually had your identity stolen as a result of the breach -- and can show that the theft hurt you financially. (Perhaps an erroneous credit report prevented you from starting a business, for instance, or someone ran up debts in your name and creditors sued you for them in court -- leading to hefty legal bills.)

Even in such circumstances, these cases can be difficult to win, lawyers say -- because you would need to show thieves stole your identity from Equifax and didn't obtain it some other way. Equifax could also try to force your case into arbitration, an alternative way to settle consumer disputes. Although the company has promised not to do this for data breach claims, it isn't clear how reliable those promises are.

Still, if the data breach leads to a spate of identity thefts that harm consumers, legal experts say it wouldn't be surprising to see individual lawsuits against Equifax. "It depends on how the thieves use the information," Seton Hall law professor David Opderbeck.

Class Actions

Don't have a tangible injury that will make it worth hiring a lawyer? Class actions, which allow lawyers to sue on behalf of a class of thousands (or millions) of plaintiffs, are designed for situations just like this one: when a company has harmed a large number of people in a way that might be relatively minor for any individual, but collectively serious. And indeed, almost as soon as the data breach was disclosed, lawyers began to file class actions against Equifax; there are now as many as 50 cases pending.

In theory, Equifax's liability could be enormous, according to University of Minnesota law professor William McGeveran. Federal law fixes damages for violating Fair Credit Reporting Act at $1,000 per violation -- an amount that, multiplied by the number of victims, could put the company out of business.

However, settlements for similar corporate data breaches cases in the past have been for far less, McGeveran says. Earlier this year, for instance, retail giant Target agreed to pay $18.5 million after hackers hackers stole personal information from up to 40 million credit and debit cards in 2013. (In other words, it paid somewhere in the neighborhood of 50 cents per stolen card.)

You don't need to do anything, at least for now, to benefit from a class action. When these suits are settled, plaintiffs lawyers typically reach out to consumers in the class -- often through mass mailing -- offering a chance to claim their share of the proceeds. In Equifax's case, the company may eventually be able to identify the victims directly from its records. You could simply get a check in the mail. But keep this in mind: If a class-action settlement does lead to payouts, however small, accepting the money will likely close off your right to file a separate suit if you later discover more serious harm.

Small Claims Court

Shortly after the Equifax news broke, an enterprising Stanford senior designed a Web site that would let consumers file a small claims lawsuit against Equifax by filling out an online form. The story was quickly picked up around the Internet.

Should you try it? Maybe, if goal is political theater, according to Paul Bland, executive director of Public Justice, a public interest group. "It might make sense as a kind of guerrilla tactic," he says of a small claims suit. "Equifax doesn't want to send a Yale-trained lawyer to defend itself against 100 lawsuits in Silver Springs, Md.," says Bland.

But even if filing a case is somewhat easier this way, winning a case won't necessarily be. Any judge would expect you to quantify the harm the Equifax breach caused you, Bland says -- and merely putting an hourly rate on the time you spent dealing with it would probably be insufficient. You'll also have to articulate a legal argument based on the Fair Credit Reporting Act, or some other relevant part of the law. "It's going to be complicated," Bland says.

Regulatory Action

Private lawyers aren't the only ones Equifax may have to tussle with: The Massachusetts attorney general filed a lawsuit against the company on Tuesday, and other states may follow suit. The Federal Trade Commission and the Consumer Financial Protection Bureau have also launched separate investigations.

In the past, actions brought by regulators, including the CFPB and state attorneys general, have sometimes led to disbursements to consumers. Yet the agencies have limited power in this case, according to Peter Henning, a Wayne State law professor who writes a white-collar crime column for The New York Times.

"The F.T.C., which broke with tradition by publicly confirming that it had launched an investigation of Equifax, cannot hit companies with heavy fines, at least for a first offense. And the C.F.P.B. has limited power to impose penalties because it deals primarily with misleading information or products provided to consumers," he wrote recently. A more likely goal would be to get Equifax to agree to free credit freezes or some other remedy, says Bland.

One plus: Unlike with a class action settlement, accepting money from a regulatory settlement isn't likely to close off your future right to sue -- although any damages you might eventually win could be reduced by the amount you received earlier, say legal experts.