How a Few People Took Equifax to Small Claims Court Over Its Data Breach and Won

Posted June 20, 2018 4:47 p.m. EDT

Christina Bernstein’s check finally arrived last week: $7,440 from Equifax for her trouble.

She was one of more than 145 million Americans whose financial information was exposed in the company’s huge data breach last year. Most got an apology and free credit monitoring from the consumer data clearinghouse, but Bernstein and a few others found a way to get compensated for their aggravation: Take the corporate giant to small claims court.

Many who try don’t succeed, but a few have reached confidential settlements and others, like Bernstein, have prevailed, even if their victories were bittersweet.

“I’m happy to get the money, but it’s not really over because I know my information has been leaked and you can never put it back,” said Bernstein, a small-business owner in San Francisco.

It was that frustration and sense of helplessness after the breach, as well as the company’s response, that first motivated many to pursue Equifax in local court.

“It’s sort of important for the human organism to do what you can do,” said Jessamyn West, a library technologist in central Vermont who won a judgment there against Equifax this month.

Those who have won against the company in court say that the key to their success was being prepared and having proof of the harm they experienced — receipts, for example, for services they would not otherwise have purchased. Research local laws that might apply, they advised. Document everything.

“Take screenshots of internet pages; if you get weird phone calls, keep your phone records,” Bernstein said.

There are, of course, higher-profile legal battles underway — the kind in which teams of lawyers spend years battling over enormous sums. Chief among them is a fight before the U.S. District Court in Atlanta, where nearly 400 separate lawsuits from thousands of people and businesses will be consolidated into one class-action case.

But that could take some time to resolve. And even if Equifax loses, victims of the breach may not see much in the way of monetary damages after lawyers take their cut and the winnings are sliced into millions of pieces.

That’s why Christian Haigh, a co-founder of Legalist, a startup that pays for litigation on a contingency basis, decided to go it alone, too.

“If you have a class-action lawsuit, a large proportion of it is going to a lawyer or a legal team,” he said. “The other thing is small claims is very fast.”

He and Bernstein filed their claims in the same San Francisco court just days apart and both won final judgments in their favor on March 8, six months after Equifax announced its breach.

Haigh received $5,490, but not all successful cases involve such large sums. West was awarded only $690, about a seventh of what she had requested.

The judge who listened to her and an Equifax representative lay out their arguments in a small-town Vermont courthouse last month agreed that West had suffered from the hacking, but awarded her just enough to cover court costs and two years of identity theft protection, instead of the five years that she had sought.

But, for West, the case was never about the money she could win, which she plans to donate, anyway. It was, at least in part, a form of activism, she said. And while everyone has their reasons, frustration with Equifax was a common theme.

The company failed to act on a March 2017 warning from federal authorities about a vulnerability that hackers would later exploit, resulting in the exposure of millions of consumers’ Social Security numbers, driver’s license numbers and other sensitive personal information.

Even after the breach, Equifax fumbled its response, briefly directing worried consumers to a fake, unaffiliated website. By its own admission, the security lapse had cost the company almost $243 million by the end of the first quarter of this year.

For many, those missteps were a motivation to act. No matter how futile it seemed to take on a multibillion-dollar corporation, local courts at least offered an opportunity to hold Equifax to account.

“They have a responsibility to either get back to you or lose,” West said of the small claims process. “That’s the most fascinating thing.”

For Bernstein, who runs a medical device consulting business, the Equifax breach was particularly frustrating because it threatened to interfere with her ability to apply for government grants. Because the grants often require credit checks, a credit freeze, which experts recommended after the breach, was out of the question.

“I really don’t need this aggravation with my credit and my phone number and, God knows, maybe my bank account numbers being leaked all over the internet,” she recalled thinking.

A judge in San Francisco Superior Court agreed, ordering Equifax to pay not only for the cost of credit monitoring, but also for the emotional distress and time Bernstein spent trying to get through to the company. On appeal, another judge reduced the award by about $2,000, setting it at $7,440.

In the end, Bernstein received restitution and relief: Last week, just days before receiving the Equifax check, Bernstein opened an envelope containing another check, this one for $15,000 for a grant she had just been awarded.