(TNS) -- The city of Chicago is suing Equifax, hoping to impose penalties on the credit reporting bureau and seeking restitution for Chicagoans whose sensitive data might have been stolen as part of a widespread breach.
The lawsuit, filed Thursday in Cook County Circuit Court, alleges Equifax violated the city’s consumer fraud ordinance and state laws by doing a poor job of protecting sensitive data from hackers and by not alerting the public more quickly when the breach was discovered. Faster notification would have allowed consumers to take steps more promptly to make it less likely that their identities would be misused, the city alleges.
“A financial fraud was committed here, and it was committed by a company that consumers entrust to actually protect them from this type of breach,” Mayor Rahm Emanuel said Thursday morning at a news conference announcing the lawsuit. “And more importantly than just the breach, they did not notify any of the consumers in a timely manner.”
Officials have said 5.4 million Illinoisans were among the estimated 143 million consumers affected by the breach, which lasted from mid-May through July. Emanuel said the city doesn’t yet know how many of those affected were Chicago residents.
Numerous lawsuits already have been filed against Atlanta-based Equifax, including one the city of San Francisco filed Tuesday and another Massachusetts filed earlier this month.
Equifax declined to comment on the pending litigation and said its “primary focus remains on helping and listening to consumers.”
Chicago is alleging violations of its Consumer Fraud, Unfair Competition or Deceptive Practices Ordinance, under which any "unlawful practice" under the Illinois Consumer Fraud and Deceptive Business Practices Act is subject to fines ranging from $2,000 to $10,000 for each offense and for “each day that a violation continues.”
The lawsuit also seeks restitution for Chicago consumers whose information was compromised.
Because the number of Chicagoans affected by the breach remains unclear, neither Emanuel nor Corporation Counsel Ed Siskel could say how much the city or individual consumers could expect to receive if the city’s lawsuit succeeds or Equifax settles the case.
“That’s part of the problem here, when the company doesn’t take prompt measures to address the situation,” Siskel said.
The lawsuit’s allegations include: failure to give prompt notice of a data breach, deceptive and unfair practices while failing to safeguard personal information, and a deceptive practice when Equifax required consumers to waive legal rights and misrepresented its credit monitoring services as free. Equifax later revised those policies after public criticism.
“Affected members of the public, including Chicago residents, have spent, and will continue to spend, money, time, and other resources attempting to protect against the increased risk of identity theft or fraud,” the lawsuit says, “including by placing security freezes on their credit files and monitoring their credit reports, financial accounts, health records, government benefit accounts, and any other account tied to or accessible with a social security number.”
Equifax still hasn’t properly notified Chicago residents that their data has been breached, the lawsuit alleges.
“Chicago is not required to demonstrate harm to its residents in order to enforce the ordinance,” the lawsuit says. “Nevertheless, Chicago residents clearly have already suffered significant and lasting harm as a result of the data breach.”
Meanwhile, Illinois Attorney General Lisa Madigan’s office said it is leading a group of states that is investigating the breach.
"We have made numerous demands of the company to immediately provide better relief to consumers who were potentially affected, and we also continue to investigate how the breach occurred and the timing of its public announcement of the breach,” Madigan’s office said in a statement.
©2017 the Chicago Tribune Distributed by Tribune Content Agency, LLC.