Equifax
Disclosed Sep 7, 20179 years ago147,000,000 affectedSettled
2017 breach of 147M people; up to USD 700M FTC/CFPB/states settlement
Attackers exploited an unpatched web application flaw at Equifax between May and July 2017 and stole names, Social Security numbers, birth dates, addresses and some payment card records of about 147 million people. Equifax agreed to pay at least USD 575M and up to USD 700M to the FTC, CFPB and 50 states and territories, and was fined GBP 500,000 by the UK ICO.
What is known
| People affected | 147,000,000 (as reported by the organization) |
|---|---|
| Disclosed | Sep 7, 2017 |
| Discovered | Jul 29, 2017 |
| Happened | May 13, 2017 |
| Attack | Hacking |
| Data exposed | Names, Social Security numbers, Dates of birth, Addresses, Government IDs, Payment cards |
| Sector | Finance · US |
| Status | Settled |
| Lawsuit or fine | USD 575M to 700M FTC/CFPB/states settlement (July 2019); GBP 500,000 ICO fine (Sept 2018) (about $700M) |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Equifaxoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Equifaxatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Equifaxjustice.oregon.gov · Official notice | Official notice |
| Equifax to Pay $575 Million as Part of Settlement with FTC, CFPB, and States Related to 2017 Data Breachftc.gov · Regulator | Regulator |
| Equifax Announces Cybersecurity Incident Involving Consumer Information (8-K Ex. 99.1)sec.gov · SEC filing | SEC filing |
| NY AG: Equifax USD 600 Million paymentag.ny.gov · Regulator | Regulator |
| 2017 Equifax data breach (Wikipedia)en.wikipedia.org · News | News |
| Equifax slapped with UK's maximum penalty over 2017 data breachtechcrunch.com · News | News |
| Indiana Attorney General 2017 data breach report: Equifaxin.gov · Official notice | Official notice |
| Maine Attorney General breach notice archive: Equifaxmaine.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Sep 7, 2017 | |
| Washington AGresidents of WA | Sep 7, 2017 | 3,243,664 |
| Oregon DOJresidents of OR | Sep 7, 2017 | 143,000,000 |
| Researchtotal | Sep 7, 2017 | 147,000,000 |
| Researchtotal | Sep 7, 2017 | 147,000,000 |
| Indiana AGresidents of IN | Sep 7, 2017 | |
| Maine AGresidents of ME | Sep 7, 2017 | |
| Maine AGresidents of ME | Oct 12, 2017 |
Other breaches at Equifax
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Mar 20, 2015Mar 20, 201511 years ago | Mar 20, 201511 years ago | Not stated | Tech | Confirmed | 1,382 |
| Disclosed Sep 6, 2013Sep 6, 201313 years ago | Sep 6, 201313 years ago | Not stated | Tech | Confirmed | Unknown |
History of this record
- 2026-09-25 · notice_affected: empty to or-doj: 143000000 (restored: the portal's own figure) · correction source
- 2026-09-25 · notice_affected: or-doj: 143000000 to · correction source
- 2026-09-25 · source: empty to https://www.maine.gov/ag/sites/maine.gov.ag/files/docs/Data%20breach%20spreadsheet%208-1-2021%20through%2012-5-2018%20REDACTED.xlsx · backfill source
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-date-Report-2017.pdf · backfill source
- 2026-09-25 · fine_usd: 575000000 to 700000000 · seed source
- 2026-09-25 · lawsuit: At least $575M, up to $700M, settlement with FTC, CFPB and 50 states and territories (2019) to USD 575M to 700M FTC/CFPB/states settlement (July 2019); GBP 500,000 ICO fine (Sept 2018) · seed source
- 2026-09-25 · summary: Equifax said criminals exploited a US website application vulnerability and accessed names, Social Security numbers, birth dates, addresses and some driver's license numbers, plus card numbers for about 209,000 people. It first reported 143 to Attackers exploited an unpatched web application flaw at Equifax between May and July 2017 and stole names, Social Security numbers, birth dates, addresses and some payment card records of about 147 million people. Equifax agreed to pay at · seed source
- 2026-09-25 · title: Web application flaw exposes personal data of 143 million US consumers to 2017 breach of 147M people; up to USD 700M FTC/CFPB/states settlement · seed source
- 2026-09-25 · status: confirmed to settled · seed source
- 2026-09-25 · fine_usd: empty to 575000000 · seed source
- 2026-09-25 · lawsuit: empty to At least $575M, up to $700M, settlement with FTC, CFPB and 50 states and territories (2019) · seed source
- 2026-09-25 · sector: tech to finance · seed source
- 2026-09-25 · data_types: [] to ["names","ssn","dob","addresses","government-id","payment-card"] · seed source
- 2026-09-25 · records_basis: empty to organization · seed source
- 2026-09-25 · records: empty to 147000000 · seed source
- 2026-09-25 · summary: empty to Equifax said criminals exploited a US website application vulnerability and accessed names, Social Security numbers, birth dates, addresses and some driver's license numbers, plus card numbers for about 209,000 people. It first reported 143 · seed source
- 2026-09-25 · title: empty to Web application flaw exposes personal data of 143 million US consumers · seed source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2017-07-29 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.