That didn't take long.
Two Oregon women filed a class action lawsuit against Equifax Thursday evening, just hours after the credit reporting agency revealed a massive data breach that may have compromised personal information belonging to 143 million Americans.
The complaint accuses Equifax of negligence in protecting consumer data, arguing the company chose to skimp on costs rather than take adequate technical measures that might have thwarted hackers.
"Equifax knew and should have known that failure to maintain adequate technological safeguards would eventually result in a massive data breach," the document alleges. "Equifax could have and should have substantially increased the amount of money it spent to protect against cyber-attacks but chose not to."
The lawsuit seeks compensation of up to $70 billion for all consumers affected as well as a court order requiring the company to preserve all internal records related to the attack. It was filed on behalf of plaintiffs Mary McHill and Brook Reinhard in a federal court in Portland, Oregon.
The Securities and Exchange Commission also announced Friday that it is opening an investigation into the breach.
Equifax said in a statement on Thursday that the hack took place between mid-May and July 29 when the company discovered it and shut it down. The company then hired a cybersecurity firm to investigate and contacted law enforcement before disclosing it to the public this week.
Days after the attack was identified, three Equifax execs unloaded nearly $2 million in company stock. A company spokesperson denied that the execs had any knowledge of the breach at the time.
The lawyers behind the suit said they are hoping it will be a "teachable moment" for better data security.
"Ms. McHill and Mr. Reinhard hope Equifax will use this massive data breach, and their subsequent lawsuit, as a teachable moment to finally adopt adequate safeguards to protect against this type of cyberattack in the future," the document says.
Topics Cybersecurity
