US credit monitoring agency Equifax agreed to pay up to USD 700 million in a settlement stemming from a data breach that affected nearly 150 million customers, regulators said Monday.
The biggest-ever penalty in a data breach case was announced by the Federal Trade Commission and state regulators after revelations that hackers had stolen the personal details, including names, dates of birth and social security numbers, of millions of people.
"Companies that profit from personal information have an extra responsibility to protect and secure that data," FTC chairman Joe Simons said in a statement announcing the settlement.
"Equifax failed to take basic steps that may have prevented the breach that affected approximately 147 million consumers," he added.
The settlement, subject to court approval, calls for at least USD 300 million of the penalty to go to affected consumers, and to provide extra credit monitoring beyond what the company has already offered. Additional money will be added to this consumer fund based on the number of claims filed, officials said.
"As part of our settlement, Equifax will provide every American who had their highly sensitive information accessed with the tools they need to battle identity theft in the future," said New York state Attorney General Letitia James, one of the state regulators in the case.
"Equifax put profits over privacy and greed over people, and must be held accountable to the millions of people they put at risk."