The Equifax Data Breach — What Happened
From May to July 2017, hackers exploited a vulnerability in Equifax's systems and stole the personal information of approximately 147 million Americans and additional consumers in the UK and Canada. The stolen data included Social Security numbers, birth dates, home addresses, driver's license numbers, and in some cases credit card numbers. The breach was not disclosed until September 2017 — four months after discovery — which triggered additional regulatory and legal scrutiny. The FTC, CFPB, and all 50 states joined in the enforcement action. Equifax agreed to pay at least $575 million (and up to $700 million) in a settlement reached in 2019.