LEGAL PROCEEDINGS
−Removed: Litigation and Investigations related to the 2017 Cybersecurity Incident
−Removed: In 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of certain personally identifiable information of U.S., Canadian and U.K.
−Removed: Following the 2017 cybersecurity incident, hundreds of class actions and other lawsuits were filed against us typically alleging harm from the incident and seeking various remedies, including monetary and injunctive relief.
−Removed: We were also subject to investigations and inquiries by federal, state and foreign governmental agencies and officials regarding the 2017 cybersecurity incident and related matters.
−Removed: Most of these lawsuits and government investigations have concluded or been resolved, including pursuant to the settlement agreements described below and in prior filings, while others remain ongoing.
−Removed: The Company’s participation in these settlements does not constitute an admission by the Company of any fault or liability, and the Company does not admit fault or liability.
−Removed: Consumer Settlement
−Removed: On July 19, 2019 and July 22, 2019, we entered into multiple agreements that resolve the U.S.
−Removed: consolidated consumer class action cases, captioned In re:
−Removed: Equifax, Inc.
−Removed: Customer Data Security Breach Litigation, MDL No.
−Removed: 2800 (the “U.S.
−Removed: Consumer MDL Litigation”), and the investigations of the FTC, the CFPB, the Attorneys General of 48 states, the District of Columbia and Puerto Rico and the NYDFS (collectively, the “Consumer Settlement”).
−Removed: The Consumer Settlement became effective on January 11, 2022.
−Removed: Under the terms of the Consumer Settlement, the Company contributed $380.5 million to a non-reversionary settlement fund (the “Consumer Restitution Fund”) to provide restitution for U.S.
−Removed: consumers identified by the Company whose personal information was compromised as a result of the 2017 cybersecurity incident as well as to pay reasonable attorneys’ fees and reasonable costs and expenses for the plaintiffs’ counsel in the U.S.
−Removed: Consumer MDL Litigation (not to exceed $80.5 million), settlement administration costs and notice costs.
−Removed: The Company has agreed to contribute up to an additional $125.0 million to the Consumer Restitution Fund to cover certain unreimbursed costs and expenditures incurred by affected U.S.
−Removed: consumers in the event the $380.5 million in the Consumer Restitution Fund is exhausted.
−Removed: The Company also agreed to various business practice commitments related to consumer assistance and its information security program, including conducting third party assessments of its information security program.
−Removed: Other Matters
−Removed: We face other lawsuits and government investigations related to the 2017 cybersecurity incident that have not yet been concluded or resolved.
−Removed: These ongoing matters may result in judgments, fines or penalties, settlements or other relief.
−Removed: We dispute the allegations in the remaining lawsuits and intend to defend against such claims.
−Removed: Set forth below are descriptions of these matters.
Canadian Class Actions.
+Added: In 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of personal information of consumers.
Five putative Canadian class actions, four of which are on behalf of a national class of approximately 19,000 Canadian consumers, are pending against us in Ontario, British Columbia and Alberta.
3 unchanged sentences
We appealed one of the claims on which a class was certified and on June 9, 2021, our appeal was granted by the Ontario Divisional Court.
−Removed: The plaintiff has since filed a notice of further appeal with the Ontario Court of Appeal, which was argued before the Court of Appeal in June 2022.
+Added: The plaintiff filed a notice of further appeal with the Ontario Court of Appeal, and on November 25, 2022, the Ontario Court of Appeal dismissed the plaintiff’s appeal and upheld the Divisional Court’s ruling in our favor.
+Added: On January 24, 2023, the plaintiff appealed this decision to the Supreme Court of Canada.
All remaining purported class actions are at preliminary stages or stayed.
1 unchanged sentence
The U.K.’s Financial Conduct Authority (“FCA”) opened an enforcement investigation against our U.K.
−Removed: subsidiary, Equifax Limited, in October 2017.
+Added: subsidiary, Equifax Limited, in October 2017 in connection with the 2017 cybersecurity incident.
The investigation by the FCA has involved a number of information requirements and interviews.
−Removed: We continue to respond to the information requirements and are cooperating with the investigation.
−Removed: Although we continue to cooperate in the Canadian class action proceedings and the FCA investigation, an adverse outcome to any such proceedings and investigation could subject us to fines or other obligations, which could have a material adverse effect on our financial condition, results of operations, or cash flows in future periods.
−Removed: In December 2021, we received a Civil Investigative Demand (a “CID”) from the CFPB as part of its investigation into our consumer disputes process in order to determine whether we have followed the Fair Credit Reporting Act's requirements for the proper handling of consumer disputes.
+Added: We have responded to the information requirements and continue to cooperate with the investigation.
+Added: We have been advised by the FCA that it intends to send us a notice with the FCA's findings and proposed penalty, which we anticipate will result in the initiation of settlement discussions.
+Added: At this time, we are unable to predict the outcome of this FCA investigation, including whether the investigation will result in any settlement, action or proceeding against us.
+Added: In December 2021, we received a Civil Investigative Demand (a “CID”) from the CFPB as part of its investigation into our consumer disputes process in order to determine whether we have followed the FCRA's requirements for the proper handling of consumer disputes.
The CID requests the production of documents and answers to written questions.
We are cooperating with the CFPB in its investigation and are in discussions with the CFPB regarding our response to the CID.
−Removed: At this time, we are unable to predict the outcome of this CFPB investigation, including whether the investigation will result in any action or proceeding against us.
+Added: In addition, in January 2023, the CFPB informed us that its enforcement division will be investigating our previously-disclosed coding issue identified within a legacy server environment in the U.S.
+Added: slated to be migrated to the new Equifax cloud infrastructure which impacted how some credit scores were calculated during a three-week period in 2022.
+Added: We are cooperating with the CFPB in its investigation.
+Added: At this time, we are unable to predict the outcome of these CFPB investigations, including whether the investigations will result in any actions or proceedings against us.
Equifax has been named as a defendant in various other legal actions, including administrative claims, regulatory matters, government investigations, class actions and other litigation arising in connection with our business.
6 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.