The damage is not the cost of getting a new SSN, but the cost of verifying that your info is safe (still safe?). This is why companies routinely list the _cost_ of dealing with hacking incidents (scrub all the servers, pay people overtime, etc). I think it's fair to assign costs similarly for equifax.

Info monitoring is what, like $29.99 a month?

Perhaps reasonably ask for 3 years of monitoring, so $980

But those aren't actual costs incurred yet.

My SSN won't change for my lifetime, so really they need to pay that cost of monitoring. Equifax, you owe me $23,392.20. It's in your interest to pay upfront to avoid the cost of inflation.

> My SSN won't change for my lifetime

This breach, I suspect, makes that less likely to be true. After all, one of the few reasons a new SSN can be issued to someone who has one is “A victim of identity theft continues to be disadvantaged by using the original number”.

https://faq.ssa.gov/link/portal/34011/34019/Article/3789/Can...

It would be interesting to see how they define "continues to" and "disadvantaged by" here. It sounds like it may be implying that multiple occurrences of issues need to happen and just knowing that your data's been breached, but not yet abused, could be insufficient qualifications for "disadvantaged by".

That's retail and the pricing seems highly inflated. Does anyone actually buy these services at that price point?

Credit real time monitoring should be an entitlement for those whose data is being collected.

You can sue for anything. They'll have to show up to respond, or you win by default regardless of whether your case is valid or not.

This would cost them a fortune.

I cannot believe that is how the court system works in any jurisdiction... are you commenting on the US?

Stress is a damage and mental health is valuable.

The tests for stress/mental health damages are very stringent.

Isn't Equifax protected from the class action by a few levels of arbitration clauses?

Arbitration clauses agreed to by who? Do most individuals have any relationship with the credit reporting agencies beyond having their private information siphoned up behind their back? (and trying to keep a handle on that, so that their "credit score" remains favorable?)

I never signed anything with Equifax, but they still have my information. I'm sure the great majority of the ~140M records they have are in a similar position.

Yeah, they ought to apply fraud alert status automatically to everyone who was compromised. Every credit application for the next five years requires they contact you personally for new applications.

Doesn't help for all the other issues this will cause, though.

Punitive damages.

There are no "punitive damages" in U.S. Small Claims Courts. Only "actual" (out of pocket) damages.

You can, however, put whatever amount you want (up to the small claims limit) in the initial paperwork. It would get reduced to actual damages if you won. But...big companies often try to settle with you before the actual court appearance. By padding it, you set an expectation that might help. They are likely to settle if the amount is less than the cost to have someone appear.

Sort of / not really.

I guess treble damages are not called "punitive" but they're also not "actual".

https://en.wikipedia.org/wiki/Treble_damages

The GP was talking about Small Claims specifically -- I don't see anything on the linked page that refutes that. In fact, it seems like this applies very narrowly and only where specified by statute.

It was the best I could find. My understanding is that here in CA, if your landlord does not refund your deposit (or properly itemize legitimate expenses against said deposit) you can sue in small claims court and recover 3x damages, up to the small claims court maximum of $7500.

That said, I've never tried it, so it's possible my understanding is wrong.