You're right, $17B (or more, or dissolving the company) would start to actually spark off some real change in attitudes towards infosec among executives, instead of just continuing the status quo with this non-enforcement action.

The strangest part of this ordeal was when that guy from the FTC was encouraging consumers to take the monitoring on Equifax's request.

They're not even pretending to be regulated anymore, they just come out and tell the government what to say.

The senate report on this hack goes into lots of technical detail, savaging Equifax for their gross incompetence and negligence beat by beat: https://www.hsgac.senate.gov/imo/media/doc/FINAL%20Equifax%2...

Despite all this provable negligence and incompetence all laid out in writing for everyone to see they still suffered zero real consequences. This is going to keep happening over and over and over again until we decide it's unacceptable.

I actually don't think taking the monitoring is a bad idea. The $125 will not amount to much and he knew that. The monitoring does include some type of identity theft insurance I believe which could actually end up costing Equifax a lot more.

Since the settlement amount was fixed, I don't see any reason the the ftc to encourage not taking it for the wrong reasons.

Too bad the total amount is fixed. I don't care about the $125. I want them to lose a substantial amount of money so that they and everybody else start taking this more seriously.

The insurance has to be some kind of joke, they lost the data. The thing they were insuring against has already happened.

It's doubly painful, because the "free credit monitoring" on offer is provided by Equifax -- the exact company whose competence we don't trust anymore. The compensation for being affected by Equifax's security failure is a gratis security offering from that same company. For crying out loud, they could have at least paid Experian or TransUnion to do the monitoring: while they are just as shady, we don't have immediate evidence of their security incompetence.

It's like if you purchased a product that exploded, injuring you, but somehow the manufacturer was permitted to compensate you by giving you other products they manufacture. Why would you want those products? How do you know they won't also explode?

> It's doubly painful, because the "free credit monitoring" on offer is provided by Equifax -- the exact company whose competence we don't trust anymore.

The free credit monitoring is provided by Experian, not Equifax. [1]

[1] https://www.equifaxbreachsettlement.com/

Oh neat, I must have glossed over that part. Egg on my face then. It's still not great, but significantly better than I thought it was.

Of the 10 years of "free" credit monitoring, the first 4 years is from Experian but the remainder is from Equifax.

If it only looks suspicious, it is. They all golf together.

There is actually a response from the FTC about concerns relating to the credit service being offered by Equifax themselves.

Therefore the agreement stipulates that the first four years of monitoring is provided by Experian, the final 6 years, though, is still Equifax.

https://www.ftc.gov/enforcement/cases-proceedings/refunds/eq...

Also as soon as the breach happened Equifax started running on TV ads promoting their monitoring service for a fee.

They also made money from people freezing their credit and unfreezing their credit they charge a fee to unfreeze the credit report. I can't remember the exact amount but I think they wanted $10 from me to unfreeze my credit report early so I just waited out the freeze period instead... Which was inconvenient.

The life-long increased susceptibility to identity theft is worth quite a lot more than $125.

There has been a bit of pain aside from the flimsy monetary damages. To date Equifax had to manage numerous lawsuits from municipal, state and federal jurisdictions. They were investigated by FTC, SEC, Consumer Financial Protection Bureau, UK Financial Conduct Authority, UK Information Commissioner’s Office (privacy regulator) and the Office of the Privacy Commissioner of Canada. Equifax had to attend congressional hearings conducted by the House Financial Services Committee, the Senate Banking, Housing, and Urban Affairs Committee, the Senate Judiciary Subcommittee on Privacy, Technology, and the Law, the House Energy and Commerce Subcommittee on Digital Commerce & Consumer Protection and the Senate Commerce, Science, and Transportation Subcommittee on Communications. The outcome aside from monetary penalties also should factor substantial reputation damages, costs of increased regulation at both the state and federal levels, CEO Richard Smith retirement, issuance of a public apology and the IRS suspended its contract with Equifax. Further lawsuits, hearings and regulation will continue to tax Equifax.