The credit bureau Equifax will pay up to $700 million in fines and monetary relief to consumers over a massive data breach two years ago. The agreement settles claims by federal and state authorities.

ARI SHAPIRO, HOST:

Two years ago, hackers hit the credit bureau Equifax and exposed the data of nearly 150 million people. That’s more than half the adult population of the United States. Now some of the people affected by that breach stand to be compensated. Equifax will pay up to $700 million in fines and monetary relief to consumers. We’re joined by NPR’s Chris Arnold, who has been following today’s settlement with state and federal regulators.

Hi, Chris.

CHRIS ARNOLD, BYLINE: Hey, Ari.

SHAPIRO: So is most of this money actually going to go to people who were affected in some way by the breach?

ARNOLD: Well, most of it will. It looks like upwards of $400 million will go to those people. We spoke to California’s attorney general, Xavier Becerra, who was involved in the settlement along with other state and federal regulators. And here’s what he said.

XAVIER BECERRA: We’re trying to make sure that anyone who was impacted by this data security breach has a chance to recover their costs. If you lost your privacy, if identity thieves have taken advantage of your private information, you deserve to be compensated by Equifax.

ARNOLD: Now, people can conceivably get up to as much as $20,000. They got to document the time and what all this cost them. For many people, it’ll probably be a lot less. Also, if you spent money and time just signing up for preventive stuff, like credit monitoring or whatever else you had to do, the goal is that you will be compensated for that too. And they’ll pay – I think it’s $25 an hour for up to 20 hours that you had to deal with that.

SHAPIRO: I’m sure many people are asking, how do I get the money?

(LAUGHTER)

SHAPIRO: What do they have to do?

ARNOLD: I’m sure, since there were that many people involved in the breach, yes. There is a website, as there often is – equifaxbreachsettlement.com. I’m going to say that again because it’s radio – equifaxbreachsettlement.com. Assuming the court approves the settlement, people can go there. And they’ll tell you what to do. But you have to do this within the next six months to get compensation.

SHAPIRO: Within six months of court approval of the settlement.

ARNOLD: Right.

SHAPIRO: It’s always hard to get a sense of the magnitude of these penalties with huge, huge companies. Is $700 million viewed as a meaningful deterrent for a company as big as Equifax?

ARNOLD: Well, it depends on who you talk to. But with consumer advocates – not so much. We talked to Ed Mierzwinski with the nonprofit consumer advocacy group U.S. PIRG. He says, look. I mean, it’s great that people are getting some money back. That’s fantastic. But as far as a real effective deterrent…

ED MIERZWINSKI: I don’t think it’s a lot of money. I think it’s more of, hey, go away money rather than a real penalty or a punishment. And I think that’s a calculated bet by Equifax. They went in there and negotiated a parking ticket rather than a punishment.

ARNOLD: And at least some of the people affected by the breach feel the same way. We spoke with Jessamyn West from Randolph, Vt. Her information was stolen, she says. And here’s her reaction that people will be getting some money back.

JESSAMYN WEST: I mean, it’s garbage, right? Like, money isn’t going to solve this problem. Like, what we need is an overhaul of the way bank corporations are allowed to handle our personal information.

SHAPIRO: It’s interesting, Chris, that, like, Equifax wasn’t the hackers here, right? Equifax got hacked, and yet everybody wants to punish Equifax. There were hearings in Congress when news broke. Lawmakers were outraged. Explain why there was so much anger at the company that, in all likelihood, sees itself as the victim.

ARNOLD: Sure. You know, first, 150 million people – but what Equifax has in its sort of vaults of information is your credit score, which allows you to get a mortgage or a loan. They got your credit card numbers, your Social Security number. You know, and this exposed that they were not doing a good job keeping that safe.

SHAPIRO: And has any policy changed to prevent this from happening in the future?

ARNOLD: Well, very quickly, there has not been a major overhaul for regulating credit bureaus that may be coming, though. There is some bipartisan support. We should also say Equifax, in a statement, called today’s settlement, quote, “a positive step for U.S. consumers.”

SHAPIRO: NPR’s Chris Arnold, thanks a lot.

ARNOLD: Thanks, Ari.

(SOUNDBITE OF J BOOGIE’S DUBTRONIC SCIENCE SONG, “TRY ME”)

Copyright © 2019 NPR. All rights reserved. Visit our website terms of use and permissions pages at www.npr.org for further information.

NPR transcripts are created on a rush deadline by Verb8tm, Inc., an NPR contractor, and produced using a proprietary transcription process developed with NPR. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.