MADISON, Wis.–Summit Credit Union here has filed a lawsuit against Equifax over its massive data breach, and is seeking class action status on behalf of other credit unions.
The suit states that Equifax “utterly failed at this task, allowing hackers to breach the gates and gain unfettered access to the sensitive information of millions. In so doing, Equifax set off a chain reaction that threatens the trustworthiness and stability of the financial system for individuals and institutions alike.”
The $2.6-billion Summit Credit Union filed the suit in the U.S. District Court Northern District of Georgia Atlanta Division. Equifax is headquartered in Atlanta.
Summit CU notes in its suit that the breach took place due to a “potential vulnerability of the Apache Strut software (that) was no secret. Security researchers with Cisco Systems Inc. warned in March 2017 that a flaw in the Apache Struts software was being exploited in a ‘high number’ of cyberattacks. Despite this warning, Equifax continued to use the software. And Equifax was reportedly using an outdated version of Apache Struts at the time of the data breach.”
The hackers had access to Equifax’s systems for nearly three months, Summit CU added, reminding the court the company did not alert the public and financial institutions to the breach until three months after it learned of the problem.
The resulting threat of identity theft means financial institutions will be feeling the “impact,” according to the suit.
Costs to financial institutions such as Summit and other credit unions include, the lawsuit alleges:
- Significant costs in cancelling and reissuing payment cards to members or customers
- Costs related to fraudulent activity on their members’ accounts, with no recourse to recover the charge against the retailer or merchant where the fraudulent purchase was made
- Larger costs associated with entirely new accounts created by identity thieves
For those reasons and others, alleges Summit, “the breach has sent shockwaves throughout the entire financial services industry, and its reverberations will be felt for years to come.”
A copy of the Summit CU lawsuit can be found in CUToday.info’s The Vault here.