In re Equifax, Inc., Customer Data Security Breach Litigation

Equifax, Inc. (defendant) collected and reported consumer information to financial institutions for the purpose of determining consumers’ creditworthiness. Despite numerous warnings that its cybersecurity was insufficient to protect the personally identifiable information (PII) it collected and stored, Equifax did not improve its security protocols. In March 2017, a third-party software program that Equifax used announced a significant vulnerability and distributed a software patch to remedy the situation. Equifax received the warnings but did not install the patch. Hackers exploited the vulnerability to access Equifax’s systems from May 13, 2017, to July 20, 2017. The hackers acquired the PII of nearly 150 million Americans, including names, Social Security numbers, birthdates, addresses, driver’s licenses, payment information, and more. Equifax publicly announced the data breach in September 2017. Various financial institutions (institutions) (plaintiffs) sued Equifax, claiming that Equifax’s failure to properly protect consumers’ PII undermined the credit-reporting system and required the institutions to expend substantial resources to determine the impact of the data breach and establish effective means of authenticating customers and detecting fraud. The institutions asserted various claims, including a negligence-per-se claim in which the institutions alleged that Equifax’s breach of the Gramm-Leach-Bliley Act (GLBA) and its implementing regulations proved that Equifax had acted negligently. Equifax moved to dismiss all claims, including the negligence-per-se claim, arguing that they were not viable. The district court considered the motion.