San Francisco City Attorney Dennis Herrera sued Equifax Inc. on Tuesday over the credit-reporting company’s massive data breach that compromised the personal information of up to 143 million people nationwide.
Dozens of lawsuits have been filed in courts around the country by shareholders, consumers, credit unions and states since Equifax revealed the breach on Sept. 7. Herrera said Tuesday’s lawsuit is the first to be filed by a city in the U.S.
The lawsuit was filed in San Francisco Superior Court on behalf of the people of California. It charges that Atlanta-based Equifax violated a California law that prohibits illegal, unfair or fraudulent business practices.
More than 15 million of the people affected are Californians, Herrera said.
The lawsuit seeks penalties of $2,500 for each violation; restitution for Californians who bought credit monitoring services from Equifax; and an injunction prohibiting the company from violating the state law.
It alleges that Equifax violated the law by failing to protect consumers’ information; waiting six weeks to disclose the breach; and then providing confusing and misleading information to consumers.
Personal information at risk in the hacking includes Social Security numbers, dates of birth, bank account numbers and the status of credit accounts.
The lawsuit alleges, “The data breach will subject California residents to increased risk of identity theft and fraud for many years to come.”
Equifax spokesperson Ines Gutzmer said in a statement, “We cannot comment on pending litigation, but want to reassure consumers that we are remaining focused on helping them navigate the situation and providing the best customer support possible.”
“We are listening to issues consumers have experienced and their suggestions, which are helping to further inform our actions as we continue to improve this process,” Gutzmer said.