Chicago sues Equifax over massive data breach

CHICAGO (AP) - The city of Chicago filed a lawsuit Thursday against the credit reporting company Equifax over a data breach that exposed personal information of about 143 million people, including more than 5 million in Illinois.

Mayor Rahm Emanuel said the company should be held accountable for the breach and a delay in notifying consumers. The lawsuit seeks restitution for those affected.

"Chicago residents have been unnecessarily exposed to financial risks due to Equifax's irresponsible and reckless actions that prioritized profit over the privacy and safety of consumer data," Emanuel said.

Equifax disclosed this month that hackers exploited a software flaw that the company didn't fix to heist Social Security numbers, birthdates and other personal data that provide the keys to identify theft.

A spokeswoman said Thursday that Equifax cannot comment on pending litigation, but that the company is focused on helping consumers "navigate this situation."

Numerous lawsuits already have been filed over the breach, including by San Francisco and Massachusetts. The company also is facing scrutiny from Congress and other federal agencies. Its CEO stepped down on Tuesday.

The Chicago lawsuit, filed in Cook County Circuit Court, accuses Equifax of violating Chicago's consumer fraud ordinance and state laws regarding information privacy, consumer fraud and deceptive practices. The lawsuit says the company waited months to inform people who were affected, then misled consumers by initially offering "complimentary identity theft protection and credit file monitoring" that required a waiver from future legal action.

Alderman Ed Burke, who is chairman of the City Council's finance committee, called it "a breach of epic proportions."

The penalty for violating Chicago's consumer fraud ordinance includes a fine of between $2,000 and $10,000 for each offense and for each day that a violation continues.