In the days following revelations last September that big-three consumer credit bureau Equifax had been hacked and relieved of personal data on nearly 150 million people, many Americans no doubt felt resigned and powerless to control their information. But not Jessamyn West. The 49-year-old librarian from a tiny town in Vermont took Equifax to court. And now she’s celebrating a small but symbolic victory after a small claims court awarded her $600 in damages stemming from the 2017 breach.
Vermont librarian Jessamyn West sued Equifax over its 2017 data breach and won $600 in small claims court. Others are following suit.
Just days after Equifax disclosed the breach, West filed a claim with the local Orange County, Vt. courthouse asking a judge to award her almost $5,000. She told the court that her mother had just died in July, and that it added to the work of sorting out her mom’s finances while trying to respond to having the entire family’s credit files potentially exposed to hackers and identity thieves.
The judge ultimately agreed, but awarded West just $690 ($90 to cover court fees and the rest intended to cover the cost of up to two years of payments to online identity theft protection services).
In an interview with KrebsOnSecurity, West said she’s feeling victorious even though the amount awarded is a drop in the bucket for Equifax, which reported more than $3.4 billion in revenue last year.
“The small claims case was a lot more about raising awareness,” said West, a librarian at the Randolph Technical Career Center who specializes in technology training and frequently conducts talks on privacy and security.
“I just wanted to change the conversation I was having with all my neighbors who were like, ‘Ugh, computers are hard, what can you do?’ to ‘Hey, here are some things you can do’,” she said. “A lot of people don’t feel they have agency around privacy and technology in general. This case was about having your own agency when companies don’t behave how they’re supposed to with our private information.”
West said she’s surprised more people aren’t following her example. After all, if just a tiny fraction of the 147 million Americans who had their Social Security number, date of birth, address and other personal data stolen in last year’s breach filed a claim and prevailed as West did, it could easily cost Equifax tens of millions of dollars in damages and legal fees.
“The paperwork to file the claim was a little irritating, but it only cost $90,” she said. “Then again, I could see how many people probably would see this as a lark, where there’s a pretty good chance you’re not going to see that money again, and for a lot of people that probably doesn’t really make things better.”
Equifax is currently the target of several class action lawsuits related to the 2017 breach disclosure, but there have been a few other minor victories in state small claims courts.
In January, data privacy enthusiast Christian Haigh wrote about winning an $8,000 judgment in small claims court against Equifax for its 2017 breach (the amount was reduced to $5,500 after Equifax appealed).
Haigh is co-founder of litigation finance startup Legalist. According to Inc.com, Haigh’s company has started funding other people’s small claims suits against Equifax, too. (Legalist pays lawyers in plaintiff’s suits on an hourly basis, and takes a contingency fee if the case is successful.)
Days after the Equifax breach news broke, a 20-year-old Stanford University student published a free online bot that helps users sue the company in small claims court.
It’s not clear if the Web site tool is still functioning, but West said it was media coverage of this very same lawsuit bot that prompted her to file.
“I thought if some stupid online bot can do this, I could probably figure it out,” she recalled.
If you’re a DYI type person, by all means file a claim in your local small claims court. And then write and publish about your experience, just like West did in a post at Medium.com.
West said she plans to donate the money from her small claims win to the Vermont chapter of the American Civil Liberties Union (ACLU), and that she hopes her case inspires others.
“Even if all this does is get people to use better passwords, or go to the library, or to tell a company, ‘No, that’s not not good enough, you need to do better,’ that would be a good thing,” West said. “I wanted to show that there are constructive ways to seek redress of grievances about lots of different things, which makes me happy. I was willing to do the work and go to court. I look at this like an opportunity to educate and inform yourself, and realize there is a step you can take beyond just rending of garments and gnashing of teeth.”
Unless my math is rusty, this could be huge.
Even if just half of the 150 million victims won similar damages of $600, that would cost Equifax $45 Billion.
Talk about rending garments!
Stephen
I would get too excited, Stephen.
Small claims court in most states provides no state process for the winner to collect.
Being awarded damages and legal fees in small claims court is about 1% of the difficulty.
I love the graphic of “Consumer David” and “Corporate Goliath”! Too bad the story here doesn’t end the way the biblical story does…
Very nice talking with you today. I was pleased about how this all worked out and your articles really helped me piece together my arguments.
Thanks for showing us we *can* do something besides sit here and take their crap. You ROCK.
I’ll 2nd that!!
@Jessamyn Well done! Congrats!
More people should be like this women standing up to big companies instead of playing with their cell phones all day long
Or, the cost to Equifax may be exactly nothing. Most small claims courts have no enforcement arm at all for whatever award the Judge decides is due to the injured party. Equifax might just ignore the ruling in Ms. West’s favor.
That was my feeling too so I dropped a note to their lawyer/paralegal to ask what would happen next. They sent me a W-9 and said a check would follow within ten days. Haven’t seen it yet but it looks likely. And there are some enforcement mechanisms in small claims but MAN they are a hassle.
I wonder if they have any physical assets in Vermont. Nothing like filing a mechanic’s lien against it. (And no, I’m not a lawyer….)
All Small Claims judgements are totally enforceable. It’s a hassle, but all the costs involved in each step get added to the judgement that the defendant ultimately has to pay.
Typically the 1st step is to transfer the judgement to district court. Then you can file a garnishment action against anyone who owes the defendant money..Or you can have the sheriff go after any assets that are available.
If the defendant is out of state, you can transfer the judgement to a state where the defendant has assets and then go thru the same process.
While you can’t squeeze money out of someone who is broke, a company like Equifax will always layup to avoid the hassl and extra costs associated with collection efforts..
Yep, winning a small-claims petition is the easy part.
The hard part is collecting.
I don’t see where it says any of these small-claim plaintiffs have actually collect even on dime.
It’s an entirely symbolic victory that hurts Equifax about as much as a paper cut.
A loss in a class action would be a different story.
I would file a claim, but the problem is what harm has been done to me by the breech? The answer is none that I am aware of. I know that won’t stop many people from trying to get some free money, but to me that’s just theft.
Now if some smart law firm wanted to make some claims for me, even if I didn’t receive any of the money, that’s something I might be willing to do. Why? Because it sends a message to these companies that they need to stop being stupid about exposing us to financial risk by being so careless with our personal information, which by the way, I never provided to Equifax in the first place. What right do they have to build a business with my personal information and in doing so expose me to potential harm? The real breech that took place was when a financial service provider that I trusted shared my information with a 3rd party without my permission. That’s a reality that ought to scare the feces out of the financial services that use the credit reporting agencies!
No harm has been done to you by the breech? Are you not checking your bank accounts every week? Or were you checking them so frequently already, before news of this breech? Have you bought any credit-monitoring services?
You have been actively harmed by the requirement to monitor your accounts for theft and other alteration. If you aren’t monitoring your accounts, the harm could be devastating.
I have estimated that the additional effort I must give to this issue over the course of my lifetime (remember, this is a life-long problem, unless you are planning to go through the arduous process of changing your SSN/Tax ID anytime soon) at minimum wage will amount to thousands and thousands of dollars. That is if nobody ever actually steals my identity. If they do steal my identity, that amount multiplies.
In small claims court you can sue for actual damages that have a defined monetary value (cleaner ruined my overcoat, etc.). Your time does not count. Nor does buying any credit monitoring services, since you were not required to do that.
“Nor does buying any credit monitoring services, since you were not required to do that.”
Christian Haigh, at Legalist, was awarded:
“Cost of Credit monitoring (120 months at $30 per month) $3,600”
“Nor does buying any credit monitoring services, since you were not required to do that.”
That doesn’t mean it can’t be awarded. Christian Haigh, at Legalist, was awarded, “Cost of Credit monitoring (120 months at $30 per month) $3,600”
Not surprised: must have happened in a San Francisco court.
In almost any other jurisdiction that would not fly.
And, the “acting … judge pro tem”– a lawyer, stand-in judge.
What we all need to do is freeze our Equifax credit accounts. Upon seeking new credit through a car loan or credit card, etc., if the lender comes back and says it cannot access the credit report because of a freeze on the Equifax account, we say that we don’t do business with companies that do business with Equifax. Or, when seeking new credit we find out up front whether the lending company uses Equifax and refuse to do business with that lender if they use Equifax.
Of course they are all abiut the same aren’t they?
More importantly, if they can’t service the credit inquiry, they can’t make any money. I have my Equifax locked for just that “Eff you” reason.
Verizon uses Equifax to process and verify new accounts.
She lost more than she won economically but interesting exercise. I suspect Equifax would win on appeal (at least could make things really expensive with high degree of risk). Maybe Equifax is not trying or not reading the relevant case histories (Brazos, Stollenwerk, etc.)
I’d sooner donate the money to Consumer’s Union political action committee, and lobby to slap some regulations on the credit services; they’ve been getting away without increased scrutiny for years, always promising congress they can police themselves. Well obviously that is a bald face lie – so let’s put the long arm of the law in motion and start putting some sting in the results of such callous incompetence by the credit bureaus!
There are few things the executive and legislative branches of government do well. Let’s not cause government to grow more with new regulations and laws.
The only way companies like Equifax will change is by crippling them with action in the courts. It’s the death by 1000 cuts that will get results.
Hmm.
Dragging myself to court to sue Equifax, on my own, is beyond my skill set.
So learning here that some lawyer group is willing to take on contingency cases sound appealing.
Legalist sub-page Equifax, “Legalist has been overwhelmed by the number of responses and applications that it has received and processed over the last few weeks. ..While we are no longer able to fund additional cases, we are using this page as a resource for individuals…”
No!
🙁
Much sadness.
I sued in small claims and as mentioned in the comments from other readers, the judge could not find a reason that we had been damaged, there were over 200 other small claims cases against Equifax in the California Small Claims Court I filed in and not one case was awarded anything. This just infuriates me because I have been damaged. The judge felt if there were no actual monetary losses, none of us had a case against the big data leaker of the century.
Eauafax ?= pay from whos pockets?? Offcourse from the tax payers pockets.
Its like game when you loose you dont pay with your own money the fines those who are respinsible all this they still live in nice mansions,simple! Who to blame? Blane just the system it works lol
Does anyone know of a guide as to the best way to go through this process for various states (New York for me). If this was out there I would gladly sue Equifax, and I’m sure others would as well.
Similar with me. Looks like luck of the draw of which judge hears the case.
One I ran across so far Legalist, sub-page Equafax.
A notable law site has general information about state small claims details. Click on the state name. [1]
There’s no need to join a class action if you got the Equifax website message, “our records indicate your personal information was impacted by this incident”. A hearing is set for November 30. [2]
[1] http://www.nolo.com/legal-encyclopedia/small-claims-suits-how-much-30031.html
[2] http://www.bankrate.com/personal-finance/credit/ready-to-sue-equifax-heres-what-to-know
Jason, for starters, you have to sue in a jurisdiction where Equifax has a physical presence.
Great job Jessamyn. I too being a Vermonter have used our small claims system to battle the big boys. I would be interested to know how you quantified your losses so I can file suit here in Bennington County, VT. I have froze my families reports and that did cost small amounts of money but not enough I would file a claim over.
Uh, 2 years of ID theft does not cost $600. More like $60.00. And didn’t Equifax offer ID monitoring for free through TrustedID?
Curtail to today, when there is a overload of anti aging abrade anticipate from products like feifi.gojimasker.nl/handige-artikelen/algenpakking.html creams, serums, gels and powders that all influence over to be this well-head of youth. Some postulate sento.gojigezicht.nl/voor-de-gezondheid/estee-lauder-anti-wrinkle-collection.html their anti aging entrancing via ingredients that go to bat for a ton of unqualified inspection tingfol.gojimasker.nl/informatie/gamila-secret-handcreme.html and appreciation on how incrustation ages to risked on a shore up them up and some are pasteurized hype.
Spammer!
I fail to see the relevancy of stating Ms. West’s age when Mr. Haigh’s age is not stated. Is there an unstated point that is trying to be made?
What really needs to change is the assumption in the legal community that all a person’s information is worth to them is the ability to open a line of credit. Payment to individuals should be assessed on the same value scale that companies like Equifax use when putting together the data products they sell to other data brokers. It also should take into account the potential for damage based on permanence of the data. (How likely are you to get a new social security number?)
bye bye equifax
Only caution is that by doing it in small claims court, you aren’t able to be included in any more class action lawsuits, and if someone DOES steal your identity in the future and you are out thousands of dollars in expenses, you can no longer get anymore of it back.
In other words, you give up all future claims by doing this.
IANAL
Nice article Brian, definitely a gentle kick to anyone reading it that they should raise a claim with the US Justice system.
Tiny typo, you have “DYI”, but probably meant “DIY”.