Massachusetts Equifax Data Breach Lawsuit Survives Dismissal Bid

Earlier this week, a Massachusetts state judge denied a motion by Equifax Inc. to dismiss a lawsuit filed by the state’s attorney general, finding that Attorney General Maura Healey plausibly alleged that Equifax broke state law when it failed to run a security patch before hackers infiltrated the computer systems in 2017, resulting in a massive data breach that exposed the personal information of 143 million consumers.

Suffolk County Superior Court Judge Kenneth W. Salinger noted that the data breach itself did not violate Massachusetts law, the alleged failure to safeguard its data could potentially be a violation.

Attorney General Healey argued that Equifax failed to properly safeguard its databases and failed to provide timely notice about the Equifax data breach.

Healey argues that Equifax knew or should have known by March 7, 2017 that there was a security vulnerability in some of its open source computer code. She says Equifax failed to upgrade or patch its software to fix this vulnerability, leaving its databases vulnerable to hackers.

The Massachusetts Equifax lawsuit also accuses Equifax of failing to take reasonable steps to determine whether hackers may have breached its computer systems. She claims these failures violate Massachusetts law.

Judge Salinger found that Healey plausibly argued that Equifax knew (or should have known) for months that it needed to patch its open source code in order to keep its databases secure because the software provider issued public notice of the vulnerability and how to fix it.

Despite this notice, Equifax allegedly failed to take steps to safeguard the data, and reportedly breached its legal duties to address all reasonably foreseeable risks to its data security and to implement reasonably up-to-date patches to its software as required by Massachusetts law.

Judge Salinger found that Healey plausibly suggested Equifax violated state law. He denied Equifax’s motion to dismiss the data breach lawsuit and will allow the Massachusetts case to proceed. The order was made public on Wednesday.

“Today’s order confirms that Equifax is not above the law and can be held accountable for violating the rights of Massachusetts consumers,” Healey said in a statement. “We are prepared to make our case in court to protect our residents and prevent a breach like this from ever happening again.”

In September, Equifax announced that it had been hit with a massive data breach that affected 143 million consumers. Since this announcement, the credit reporting company has been faced with mounting litigation, including an Equifax data breach class action lawsuit that was filed shortly after the announcement.

The Equifax data breach reportedly exposed customer data such as names, Social Security numbers, birth dates, email addresses and other personal identification information. More than 200,000 credit card numbers were also accessed, Equifax said.

Massachusetts consumers are represented by Attorney General Maura Healey and Assistant Attorneys General Sara Cable, Tared Rinehimer and Michael Lecaroz.

The Massachusetts Equifax Data Breach Lawsuit is Commonwealth of Massachusetts v. Equifax Inc., Case No. 1784-cv-3009, in Suffolk County Superior Court.