In a David-and-Goliath moment, a 49-year-old librarian has won damages against credit giant Equifax, in the wake of its head-spinningly massive 2017 data breach.
It’s a small but significant victory: a small claims court awarded $600 to Jessamyn West, native of the small town of Randolph in Orange County, Vermont.
West told Threatpost in a phone interview that she filed the claim herself in her local courthouse, asking for $5,000 for speculative damages. The idea was to pay for future expenses for the LifeLock ID theft service and credit-monitoring for herself and family members. However, that sort of future expense modeling isn’t allowed in small claims court. Instead of dismissing the case, the reduced sum represents what a year of LifeLock ($360) and the identity monitoring ($240) would have cost her for a year going back to when the breach happened.
West, who in addition to being a librarian is a social activist and speaker on issues around the digital divide, privacy and other technology issues, said that in the wake of the breach, she noticed a palpable sense of impotence when it came to people affected by the incident.
Jessamyn West, librarian and technology advocate, at home in Vermont.
Equifax, which reported more than $3.4 billion in revenue last year, recently clarified that the number of impacted U.S. consumers from the infamous breach now totals about 147.9 million. The breach has touched almost every adult in the U.S., with more than 45 percent of the population directly affected by the incident. Information stolen included names, Social Security numbers, dates of birth, addresses, emails, gender and more.
“The reporting around it was along the lines of, ‘everyone’s in trouble, and you can do nothing!” she told us. “The stories weren’t geared towards the average computer user, and there seemed to be a lot of people who want to foment fear and uncertainty. I wanted to provide some kind of alternative, to show that we don’t have to sit there and take it. We do have some things that work for us, like the court system. Small claims is made for people to get redress, even from giant corporations that don’t care about one person’s private problems.”
West said that she was influenced in her decision to file suit by a news story about a 20-year-old Stanford University student who created a free online bot to help users take cases to small claims court.
“But it was only for California and New York,” she said. “But I thought, small claims can’t be that difficult, right? I felt that anyone can do it, because the system is there for anyone to use. There was a website that kind of stepped me through it, and after a little bit of time and a little bit of money — $90 – I filed.”
Her win however came as a surprise.
“Stunned may be too strong a word – or maybe it isn’t,” she said. “I really didn’t expect to win anything – I knew some people had won but they seemed more ‘lawyery’ than me. My friends thought there was no way. And when I emailed the Equifax paralegal, he said ‘we’ve won every single one except the three you read about in the paper.'”
In the end however, West prevailed. She said she plans to donate the money to the Vermont chapter of the American Civil Liberties Union (ACLU), and added that she hopes her case inspires others to stand up and use their civic rights in cases like this.
“My whole point was about having a better story to talk about instead of feeling like there’s nothing you can do – raising awareness of online privacy and how it’s possible to deal with big stupid companies doing big stupid things,” she told Threatpost. “My neighbors were like, way to go! It’s nice to see someone doing something! On Reddit, a lot of the comments are along the lines of ‘wow, maybe I can I do this, how does that work?’ People really find a lot of these systems completely inscrutable. But the reality is that small claims is available to you in every state, for a little money and some paperwork.”
Equifax faces a handful of individual cases, along with at least two class action suits, both filed in Atlanta, the company’s hometown. One consolidates more than 240 lawsuits seeking class-action status that were filed against Equifax within weeks of the breach notification.
Another argues that an estimated 28 million small business operators face special risk in terms of the cost of Equifax business reports, the availability of credit and exposure to business identity theft, which often is directly linked for small business owners to their personal credit.
