What changed in this filing

/stocks — the workspaceLOADING

Item 3. Legal Proceedings

2022-02-24 compared with 2021-02-25 · 25 added, 25 removed, 47 unchanged (52% of the section changed)

1 unchanged sentence

Litigation and Investigations related to the 2017 Cybersecurity Incident

In fiscal 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of certain personally identifiable information of U.S., Canadian and U.K.

In 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of certain personally identifiable information of U.S., Canadian and U.K.

Following the 2017 cybersecurity incident, hundreds of class actions and other lawsuits were filed against us typically alleging harm from the incident and seeking various remedies, including monetary and injunctive relief.

8 unchanged sentences

2800 (the “U.S.

Consumer MDL Litigation”), and the investigations of the FTC, the CFPB, the Attorneys General of 48 states, the District of Columbia and Puerto Rico (the "MSAG Group") and the NYDFS (collectively, the “Consumer Settlement”).

Under the terms of the Consumer Settlement, the Company will contribute $380.5 million to a non-reversionary settlement fund (the “Consumer Restitution Fund”) to provide restitution for U.S.

Consumer MDL Litigation”), and the investigations of the FTC, the CFPB, the Attorneys General of 48 states, the District of Columbia and Puerto Rico and the NYDFS (collectively, the “Consumer Settlement”).

Under the terms of the Consumer Settlement, the Company agreed to contribute $380.5 million to a non-reversionary settlement fund (the “Consumer Restitution Fund”) to provide restitution for U.S.

consumers identified by the Company whose personal information was compromised as a result of the 2017 cybersecurity incident as well as to pay reasonable attorneys’ fees and reasonable costs and expenses for the plaintiffs’ counsel in the U.S.

7 unchanged sentences

Consumer MDL Litigation.

The MDL Court entered an amended order granting final approval of the settlement on March 17, 2020.

Several objectors have appealed the final approval order.

Until the appeals are finally adjudicated or dismissed and the settlement becomes final in accordance with its terms, we can provide no assurance that the U.S.

Consumer MDL Litigation will be resolved as contemplated by the settlement agreement.

If the Court’s order approving the settlement agreement was overturned by an appellate court and not cured in accordance with the terms of the consent orders with the FTC and CFPB, the consent orders with the FTC, CFPB and MSAG Group would remain in place and the Consumer Restitution Fund would be administered by the FTC.

In that event, there is a risk that we would not be able to settle the U.S.

Consumer MDL Litigation on acceptable terms or at all, which could have a material adverse effect on our financial condition.

Other Settlements

Financial Institutions MDL Class Action .

On May 15, 2020, the Company entered into a settlement agreement to resolve the consolidated financial institutions class action cases pending before the MDL Court (the “Financial Institutions MDL Litigation”).

Under the settlement, the Company agreed to pay for valid claims submitted by class members up to a maximum amount, reasonable settlement administration and notice costs, and reasonable attorneys’ fees and expenses.

The Company also agreed to adopt and/or maintain certain business practices related to its information security program.

The court granted final approval of the settlement on October 22, 2020.

The MDL Court entered an amended order granting final approval of the settlement (the “Final Approval Order”) on March 17, 2020.

Several objectors appealed the Final Approval Order to the U.S.

Court of Appeals for the Eleventh Circuit (the “Eleventh Circuit”).

On June 3, 2021, the Eleventh Circuit issued an order reversing the MDL Court’s grant of incentive awards to class representatives, but affirming all other aspects of the Final Approval Order.

Several objectors filed petitions with the Eleventh Circuit seeking a rehearing, and on July 29, 2021, the Eleventh Circuit denied those petitions.

On August 12, 2021, the MDL Court made the Eleventh Circuit’s mandate the judgment of the MDL Court.

Two objectors filed petitions for a writ of certiorari with the U.S.

Supreme Court, and on January 10, 2022, the U.S.

Supreme Court denied the last remaining petition.

On January 11, 2022, the Consumer Settlement became effective.

Other Matters

4 unchanged sentences

Georgia State Court Consumer Class Actions.

Four putative class actions arising from the 2017 cybersecurity incident were filed against us in Fulton County Superior Court and Fulton County State Court in Georgia based on similar allegations

and theories as alleged in the U.S.

Four putative class actions arising from the 2017 cybersecurity incident were filed against us in Fulton County Superior Court and Fulton County State Court in Georgia based on similar allegations and theories as alleged in the U.S.

Consumer MDL Litigation and seek monetary damages, injunctive relief and other related relief on behalf of Georgia citizens.

1 unchanged sentence

On July 27, 2018, the Fulton County Business Court granted the Company’s motion to stay the remaining single case, and on August 17, 2018, the Fulton County Business Court granted the Company’s motion to stay the consolidated case.

These cases remain stayed pending final resolution of the U.S.

Consumer MDL Litigation.

Because the plaintiffs in the four putative class actions did not opt out of the Consumer Settlement that became effective on January 11, 2022, these cases have been dismissed and are now closed.

Canadian Class Actions.

Five putative Canadian class actions, four of which are on behalf of a national class of approximately 19,000 Canadian consumers, are pending against us in Ontario, British Columbia and Alberta.

Each of the proposed Canadian class actions asserts a number of common law and statutory claims seeking monetary damages and other related relief in connection with the 2017 cybersecurity incident.

In addition to seeking class certification on behalf of the approximately 19,000 Canadian consumers whose personal information was allegedly impacted by the 2017 cybersecurity incident, in some cases, plaintiffs also seek class certification on behalf of a larger group of Canadian consumers who had contracts for subscription products with Equifax around the time of the incident or earlier and were not impacted by the incident.

proposed Canadian class actions asserts a number of common law and statutory claims seeking monetary damages and other related relief in connection with the 2017 cybersecurity incident.

In addition to seeking class certification on behalf of Canadian consumers whose personal information was allegedly impacted by the 2017 cybersecurity incident, in some cases, plaintiffs also seek class certification on behalf of a larger group of Canadian consumers who had contracts for subscription products with Equifax around the time of the incident or earlier and were not impacted by the incident.

On December 13, 2019, the court in Ontario granted certification of a nationwide class that includes all impacted Canadians as well as Canadians who had subscription products with Equifax between March 7, 2017 and July 30, 2017 who were not impacted by the incident.

Our motion for leave to appeal this decision was granted in part, and our appeal is now pending.

We appealed one of the claims on which a class was certified and on June 9, 2021, our appeal was granted by the Ontario Divisional Court.

The plaintiff has since filed a notice of further appeal with the Ontario Court of Appeal, which is scheduled to be heard in June 2022.

All remaining purported class actions are at preliminary stages or stayed.

Government Investigations.

We have cooperated with federal, state and foreign governmental agencies and officials investigating or otherwise seeking information, testimony and/or documents, regarding the 2017 cybersecurity incident and related matters.

Except as described below, these investigations have been resolved as discussed in prior filings or there has been no further activity.

The U.K.’s Financial Conduct Authority (“FCA”) opened an enforcement investigation against our U.K.

2 unchanged sentences

We continue to respond to the information requirements and are cooperating with the investigation.

Although we continue to cooperate in the Canadian class action proceedings and the FCA investigation, an adverse outcome to any such proceedings and investigation could subject us to fines or other obligations, which could have a material adverse effect on our financial condition and results of operations.

In December 2021, we received a Civil Investigative Demand (a “CID”) from the CFPB as part of its investigation into our consumer disputes process in order to determine whether we have followed the FCRA's requirements for the proper handling of consumer disputes.

The CID requests the production of documents and answers to written questions.

We are cooperating with the CFPB in its investigation and are in discussions with the CFPB regarding our response to the CID.

At this time, we are unable to predict the outcome of this CFPB investigation, including whether the investigation will result in any action or proceeding against us.

Equifax has been named as a defendant in various other legal actions, including administrative claims, regulatory matters, government investigations, class actions and other litigation arising in connection with our business.

7 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 3. Legal Proceedings