Equifax Data Breach: What Was Exposed and the Settlement

One of the largest breaches in US history began with a missed software patch. The 2019 settlement shows what was exposed and what people could claim.

By Siddharth ShankarUpdated October 11, 2026

When people talk about a "huge breach," Equifax is usually the example. It was a credit bureau, so it held exactly the details that criminals need to open accounts in someone else's name. The FTC's July 2019 announcement of the settlement is a clear summary of what was exposed and what went wrong.

What happened

The FTC announced that Equifax agreed to pay at least $575 million, and potentially up to $700 million, as part of a settlement with the FTC, the Consumer Financial Protection Bureau and 50 US states and territories. The breach, which occurred in 2017, affected about 147 million people.

What was exposed

The FTC says the compromised data included at least 147 million names and dates of birth, 145.5 million Social Security numbers and 209,000 payment card numbers with expiration dates, along with addresses. A Social Security number combined with a name, date of birth and address is the core set of details used for identity theft. Unlike a password, none of those can be changed easily.

What went wrong

The FTC describes a patching failure. Equifax was alerted in March 2017 to a critical vulnerability. Staff were told to patch within 48 hours, but no one confirmed that the patch had been applied. The unpatched database was found in July 2017. The FTC also says hackers reached an unsecured file containing administrative credentials in plain text.

The case is often cited because the cause was not exotic. A known vulnerability, a missed step and a lack of verification gave attackers access to some of the most sensitive records in the country.

How the settlement worked

The settlement was split into several parts. The FTC lists a $300 million consumer fund, with up to $125 million more if needed, $175 million to the states and a $100 million civil penalty to the CFPB. Consumers could claim free credit monitoring or cash reimbursement, and the settlement made up to $425 million available for time and money spent. Equifax also agreed to provide free credit reports: six per year for seven years, starting in January 2020.

The FTC release does not state how much each person eventually received, so we do not give a per-person figure.

Key facts at a glance

• Breach year: 2017
• People affected: about 147 million
• Social Security numbers: 145.5 million
• Payment card numbers: 209,000
• Settlement: at least $575 million, up to $700 million
• Free credit reports: six a year for seven years from January 2020

What you can do

What the release does not say

The release does not report the amounts actually paid to individual claimants. For a more recent case of a breach at a supplier, read our report on the Blackbaud breach.

Why Equifax is still a useful case study

Breaches at credit bureaus are unusual because people never gave the bureau their data directly. It was collected from lenders and others, so there was no relationship to cancel and no account to close. That is why the advice in this case focuses on protection rather than deletion: freeze the files, monitor them and be skeptical of messages that use your real details. The same pattern appears in later cases, where data held by vendors, processors and brokers is exposed without the person ever having chosen the company involved. In each of them the practical response is the same: assume the data may circulate and make it harder to use.

The practical next step is similar for most people. Read up on what each type of breached data means, how to tell a real breach notice from a phishing message and what to do after your email appears in a breach, then review your own accounts. You can also try our free email exposure check.