Questions loom over impact of data breach on vulnerable communities
26th August 2019 · 0 Comments
By Ryan Whirty
Contributing Writer
As consumers, political figures and government regulators contend with the Federal Trade Commission’s July 22 announcement that credit-monitoring firm Equifax Inc. agreed to a $700 million settlement following one of the largest data breaches in history, questions loom over how the 2017 breach will affect society’s most vulnerable populations.
While statistics remain elusive about the specific demographics of the 147 million consumers who were impacted when hackers severely compromised one of the three major credit-monitoring firms in the country, observers warn that the accessing of critical personal information about millions of Americans could be disastrous for those marginalized or ignored by society.
The poor, people of color and undocumented immigrants often find it difficult to track their credit scores sufficiently, and as such they often fall victim to incorrect or stolen information that in turn cripples their credit and ability to borrow.
That can be disastrous for populations already struggling, for example, to maintain a roof over their heads or afford the means with which they get to their source of employment.
“There’s a real concern there for those who are unable to monitor their credit carefully, who are burdened by other life demands, or who are just not as vigilant in making sure the details on their credit report are consistent with their actions,” said Kristin Johnson, a professor at the Tulane University School of Law. “It can make them more likely to be victims of fraud, and to be less likely to be timely in addressing the fraud that results.”
Johnson added that vulnerable members of society are often faced with challenges that hinder their ability to engage in the hours-long effort it can take to correct fraud that results from the type and magnitude of data breach experienced by Equifax and the 147 million people whose credit information was exposed.
Such life complications can include erratic or overloaded work schedules; lack of access to online or digital resources; or the lack of any credit score at all. Johnson said that last factor can severely impact undocumented migrants, who, because they have very little in the way of identification or a financial record, can be called “invisibles,” whose credit profile is easily manipulated by hackers or other digital criminals.
The Consumer Financial Protection Bureau and the 50 U.S. states joined the FTC in investigating and addressing the 2017 Equifax data breach, and those entities also took park in the resulting settlement.
Jacques Ambers, special assistant to Louisiana Attorney General Jeff Landry, told The Louisiana Weekly that Landry and his staffers are keenly aware that marginalized consumers are especially susceptible to data breaches and credit fraud, and that Landry’s office is committed to helping such populations.
“The Equifax breach was massive in scope and scale,” Ambers said. “It affected many millions of people indiscriminately. Unfortunately, low-income victims are exceptionally vulnerable to such effects of these mass thefts. That’s one reason our office has worked diligently to reach a meaningful settlement – mitigating widespread damage.”
Under the settlement, Equifax agreed to pay at least $575 million and possibly up to $700 million as punishment for the massive data breach, and for restitution to the millions of consumers who were potentially affected.
Specifically, the settlement addresses the fact that Equifax failed to shore up its safeguards when the breach occurred, an act that the FTC and others regarded as symbolic of corporate carelessness and indifference to the possible negative affect the company’s mistake had on millions of people’s lives.
Of that fine, $300 million will initially be placed in a fund that provides restitution for the hours consumers spent dealing with fraud or other problems stemming from the breach, such as attorney or accountant fees; the cost of freezing or unfreezing a credit account; or losses from unauthorized charges to a financial account.
However, the settlement provides consumers with an alternate method of compensation from Equifax – up to 10 years of free credit monitoring.
For its part, Equifax has done significant damage control in the wake of both the 2017 breach and last month’s announcement of a deal with the FTC. At least publicly and officially, the company has been careful to project a positive message to the media, to the government and to consumers whose cybersecurity was threatened by Equifax’s failures.
“This comprehensive settlement is a positive step for U.S. consumers and Equifax as we move forward from the 2017 cybersecurity incident and focus on our transformation investments in technology and security as a leading data, analytics and technology company,” said Equifax Chief Executive Officer Mark W. Begor in a prepared statement released in July.
“The consumer fund of up to $425 million that we are announcing today reinforces our commitment to putting consumers first and safeguarding their data and reflects the seriousness with which we take this matter,” Begor added. “We have been committed to resolving this issue for consumers and have the financial capacity to manage the settlement while continuing our $1.25 billion EFX2020 technology and security investment program. We are focused on the future of Equifax and returning to market leadership and growth.”
On July 30, Jacqueline Connor, an attorney with the FTC’s Division of Privacy and Identity Protection, held a telebriefing with journalists in conjunction with Ethnic Media Services. Many of the questions asked by members of the media during the briefing centered on how the Equifax data breach and resulting settlement has affected and could affect the futures of marginalized consumers, such as ethnic and racial minorities, the poor and immigrants.
However, Connor largely skirted the issue of specific demographics, instead playing up the settlement and asserting that it will trigger significant positive change for all consumers. She called the settlement “historic on many levels,” including the massive size of the breach the settlement addressed and the large number of entities that were involved in the crime, the corporate failures and the investigation into them.
Connor called it a cautionary tale for consumers, asserting that the magnitude of the breach and the type of data accessed by the hack show “how not to give [an entity] access to your data.”
Credit agencies, she added, “seem to have consumers over a barrel.”
“It’s a reality I think consumers should understand,” she said.
Connor warned of fraudulent Web sites claiming to offer payouts from the settlement and urged people to be careful when attempting to access the pool of money. She said that while the FTC handled the investigation and settlement, third-party administrators are handling the actual payout process. She encouraged consumers to go to the FTC’s official Web site for more information on how to apply for a restitution payment.
Connor did note that all the details of the settlement are available in Spanish on the FTC’s Web site, and that two FTC officials fluent in Spanish will be available to counsel individual consumers and restitution applicants.
In the weeks since the FTC announced the settlement with Equifax, the media and others have ruminated about whether the settlement provides sufficient compensation for the 147 million people whose online privacy was invaded, as well as whether the $700 million punishment even amounts to anything more than a slap on the wrist for a major corporation whose actions essentially control the futures of millions of everyday people.
One concern is how much money each consumer will receive from the $300- to $425-million pot of money funded by Equifax. Depending on how many people apply for financial restitution out of that fund, each consumer, some fear, might end of receiving much less than the $125 limit for each applicant. Some pundits stated that each person might get just $3 or $4.
For that reason, the FTC, many financial experts and media commentators are actively encouraging consumers to opt for the free credit monitoring instead of applying for cash. “The value of credit monitoring is far more beneficial than a payment,” Connor said in the July 30 telebriefing.
Beyond the bottom-line nuts and bolts of the settlement, many are questioning whether the massive Equifax breach, the company’s lax response, and the recent settlement will truly change anything in the financial industry.
It’s unclear if credit monitoring firms will actually take sizable actions to implement cyber security and safeguards to prevent such massive breaches in the future. Whether such firms learned any lesson from the incident, or whether the credit reports of the most vulnerable sections of society – the poor, people of color or undocumented workers – will ever truly be safe.
Johnson said that “data has tremendous value,” noting that in current society, “the most valuable currency is data.”
With the fates and futures of millions and millions of people constantly at stake, many feel substantial change must be taken in the financial industry.
Johnson, an influential legal scholar who recently testified before Congress on the issue of artificial intelligence in American law and public policy, said the situation has been complicated and the potential peril deepened because credit firms in recent years have begun collecting non-traditional financial data of individuals, such as utility payments, phone bills or rental record.
Johnson said that while such newer types of collected data could boost some marginalized consumers’ credit rating – especially people without a record of traditional credit data like mortgages, car payments or bank loans – on the other hand it could damage the futures of consumers who already have a fragile credit status.
And now that potential employers have begun frequently using credit ratings to decide whether to hire someone, consumers are finding that their very livelihood and ability to even make ends meet are vulnerable to the huge Equifax data breach of 2017.
“[A credit rating] may influence your ability to get a job,” Johnson said. “The score itself has significance far beyond just credit determination. As a result, the potential that your information could be compromised is highly problematic.”
This article originally published in the August 26, 2019 print edition of The Louisiana Weekly newspaper.
