Three executives — Chief Financial Officer John Gamble, Joseph Loughran, who heads its U.S. information solutions business, and Rodolfo Ploder, who runs the company's workforce solutions operation – sold nearly $1.8 million in stock in the days after Equifax discovered the cyber-attack.

The sales were not part of a scheduled sale, and Equifax said this week the three executives “had no knowledge that an intrusion had occurred at the time.”

But the company told its investors that it had “promptly” informed its board of directors of the incident.

Rick Smith, CEO of Equifax. AJC File Photo

The complaint contends the breach “was the inevitable result of Equifax’s inadequate approach to data security and the protection” of consumers’ personal information.

The Atlanta lawsuit seeks statutory damages under the federal Fair Credit Reporting Act and state statutes and other out-of-pocket losses and compensatory damages, as well as “more robust credit monitoring services with accompanying identity theft insurance. The plaintiffs also seek an order from the court requiring the company to improve its data security.

Equifax has taken heat from consumer groups for fine print in the credit and identity protection package it has offered for free to consumers hit by the breach. The fine print appears to bind consumers who agree to use the free products to arbitration, essentially giving up their rights to sue the company or join a class action case.

Equifax said in a statement Friday the arbitration clause doesn’t apply to the breach, but only to disputes that might arise with the free protection services.

Henry Turner, a Decatur lawyer with expertise in class action litigation, said in an e-mail the choice of venue in Equifax’s hometown “should be particularly interesting.”

He said that is “especially true” if the company attempts to use “the mandatory arbitration and/or class action waiver argument for all those that sign up [for] credit monitoring … to limit the putative class size and therefore the damages.”

“Remember that the language Equifax is using for these sign-ups not only contains a Mandatory Arbitration Provision but also a Class Action Waiver Provision,” he said.

Related coverage

Explore Equifax grapples with fallout from massive data breach

Explore Equifax breach may hit 143 million consumers