Equifax Faces Multibillion-Dollar Lawsuit Over Hack • Hacker News Board

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#201

Post by lr4444lr » Fri, Sep 08, 2017, 6:27 PM UTC

hedora wrote: post #17

I'd love to see the $70B number pan out (though $500 per person is less than the damages, I think) -- Equifax is a $17B company, and would presumably stop existing if that happened. On the other hand, these things always settle out of court, and Equifax certainly won't settle the suit for more than they're worth. I said it elsewhere, but I think the right response is to opt out of the class, and sue for $1000 in smal…

But then you would have to show $1000 of actual personal damage, which I doubt few if any can, unless you're thinking Equifax will just settle these one after another. But they're just as capable of multiplying out how many of these will have to happen before the losses devastate them like you just did and at some point will actually show up and make you prove your case.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#202

Post by lr4444lr » Fri, Sep 08, 2017, 6:29 PM UTC

thaumaturgy wrote: post #112

rayiner wrote: post #96

Earlier quoted context omitted.

Probably for good reason. $500 per class member is an insanely high damages estimate. 99.9% of people will suffer zero damages because their identities will not be stolen. Even the ones who do have their identities stolen will likely be made whole by the credit card companies. The real damages here are going to be to the banks and credit card companies that will have to absorb the costs of all the fraud. As to the Ti…

> Even the ones who do have their identities stolen will likely be made whole by the credit card companies. Are credit card companies now in the habit of reimbursing consumers for the considerable time and headache required to sort out fraudulent charges caused by insecure data storage practices in the credit reporting agencies that the credit card companies contract with? There are numerous reports of identity fraud…

What headache? Get with Capital One, Chase, Citi, or one of the other big names. They are very professional about replacement cards and zero hassle.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#203

Post by JumpCrisscross » Fri, Sep 08, 2017, 6:31 PM UTC

dhimes wrote: post #194

Bluestrike2 wrote: post #121

Earlier quoted context omitted.

To be fair, class action suits aren't really about recovering damages for the class members. Or at least, not entirely. That's almost incidental. Rather, they're most often about leveraging a large class of injured parties--whose injuries are usually relatively minor on an individual basis--to force a change of behavior by adding up all of those small injuries. The cost of pursuing each claim individually would usual…

To be fair, class action suits aren't really about recovering damages for the class members. Or at least, not entirely. That was exactly what they were supposed to be about. The way it usually works out, however, is that the lawyers don't really negotiate on the same side of the table as the class and the class members end up with very little. The lawyers, however, get their fees. That's why everybody gets pissed abo…

> If the lawyer wants to use my name (as a class member) for leverage in the suit, he or she should be representing me

If you're paying them they're representing you. If they spend a single client's or their own time building a case, they're not representing you. They are representing your class. If you want to be represented, opt out and hire a lawyer.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#204

Post by lr4444lr » Fri, Sep 08, 2017, 6:32 PM UTC

bodz wrote: post #190

A lawsuit seems appropriate, but I'm confused on their allegations. How can this lawsuit claim that Equifax "wasn't spending enough or doing enough to protect the information" when nobody, except for those within the company, know how much is spent or done to protect the information? Is there some public record I'm not aware of that says Equifax underspent on cybersecurity? Or is this lawsuit just a shot in the dark…

If the plaintiff's expert witnesses can be brought in to show convincingly that the nature of the breach - as we can see from the outside - suggests basic common safeguards were not taken, that could force Equifax's hand to show otherwise.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#205

Post by logfromblammo » Fri, Sep 08, 2017, 6:34 PM UTC

raisedbyninjas wrote: post #145

rayiner wrote: post #96

Earlier quoted context omitted.

Probably for good reason. $500 per class member is an insanely high damages estimate. 99.9% of people will suffer zero damages because their identities will not be stolen. Even the ones who do have their identities stolen will likely be made whole by the credit card companies. The real damages here are going to be to the banks and credit card companies that will have to absorb the costs of all the fraud. As to the Ti…

"Even the ones who do have their identities stolen will likely be made whole by the credit card companies." Fraudulent charges on a credit card are the least of my concerns. This opens us up to a lifetime of identity theft and insecure accounts of every sort. I'm not even sure how they can approach remedying the problem. Coordinate with the SSA to get 150 million people new SSNs at the least.

Why would people need new SSNs? It was the credit industry that misused them as combination of unique identifier and authenticator, and that is not the SSA's responsibility to fix. The government even tried to curb misuse of the SSN, but it was not binding on private entities, and they just ignored it.

The solution, whatever it is, does not include anyone continuing to pretend that the SSN is now or has ever been suitable for any purposes other than for tracking government benefits managed by the SSA, and possibly also for tax filings with the IRS.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#206

Post by nicpottier » Fri, Sep 08, 2017, 6:34 PM UTC

jfindley wrote: post #64

ethanwillis wrote: post #34

Earlier quoted context omitted.

Can I actually do this? Cause if I can I'm totally doing this.

IANAL, but I think you'd find it virtually impossible to show $1000 of direct, material damages as a result of having your information leaked[0] and to the best of my knowledge this is the only sort of claim that small claims courts allow - I believe they do not allow punitive damages, nor theoretical ones. 0: Unless your info is actually used in a way that harms you, and you can prove that it was a result of this, b…

Is it really so hard? Cost of a service like Equifax's own TrustedID or LifeLocks is over $100/year. Seems you could easily argue that you'd have to subscribe to said service for the next decade to guarantee your credit and identity aren't stolen?

(and I would think refusing to accept Equifax's "coupon" for TrustedID would be a similarly easy argument to make)

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#207

Post by _wp3r » Fri, Sep 08, 2017, 6:35 PM UTC

redm wrote: post #5

I'm not excited about this class action; If they win, the individual payout will be almost nothing ($10?). The lawyers are the only ones who will really "make out" with 10's of millions in fees. There is also a disproportionate effect in that a small portion of the 143 million affected will have a large impact, i.e., "identity theft" while most will be unaffected. I think a fund setup to help those who are directly a…

Don't disagree just some more thoughts.

The risk to the greatest number of people is the increase in interest rates if the lenders do not have the same level of trust in the credit reporting companies.

1% over 30 years is a lot.

Secondly, just taking preventative measures for say 10 years of credit monitoring, from not the company that leaked your data, would cost 15x12x10 $1800.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#208

Post by JumpCrisscross » Fri, Sep 08, 2017, 6:35 PM UTC

pc86 wrote: post #160

eloff wrote: post #30

It's a sign of how awful Equifax is that I find myself rooting for the lawfirms in this case. I really hope they win, and that they get the full $70 billion, and that it's enough to shutter Equifax permanently. What a win that would be! Also it would serve as a nice cautionary tale to companies that infosec matters. That insurance for data breaches matters. Because right now, it's too easy for them to not care. It's…

Yes, what a win it would be to simply transfer ownership of Equifax from one party to another in the event of bankruptcy. The business itself would continue and nothing would change.

Investors would get wiped out and many people canned. The signalling value is massive.

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#209

Post by lr4444lr » Fri, Sep 08, 2017, 6:36 PM UTC

coldcode wrote: post #124

I have said for years this credit controlling triopoly needs to be shut down and replace with something less disgusting. Ever tried to fix a mistake they made in your credit report? You may as well be dealing with the Spanish Inquisition. There is no penalty for Cxx's who perpetuate inept security to make more money so security is always job #99. These folks seem to have cornered the market on ineptness. I doubt any…

Organizations at the hazy nexus of the public-private spheres (e.g. public benefits corporations, regional transit authorities, FINRA, health insurance companies) appear to be endlessly prone to "disgusting" fallout like this, no?

Re: Equifax Faces Multibillion-Dollar Lawsuit Over Hack

#210

Post by HelloMcFly » Fri, Sep 08, 2017, 6:36 PM UTC

bodz wrote: post #190

A lawsuit seems appropriate, but I'm confused on their allegations. How can this lawsuit claim that Equifax "wasn't spending enough or doing enough to protect the information" when nobody, except for those within the company, know how much is spent or done to protect the information? Is there some public record I'm not aware of that says Equifax underspent on cybersecurity? Or is this lawsuit just a shot in the dark…

That's what the "or" is for in "wasn't spending enough or doing enough." It's evident that they did not do enough to protect the information. Spend is a proxy for action, but ultimately it's the action (or inaction) that matters here. I only see them exonerating themselves to a large degree if they engaged in routine third-party audits of their security and consistently responded to every identified issue.