“The FTC has the authority to investigate and protect the public from unfair or deceptive acts or practices, including deceptive advertising,” Warren wrote. “Unfortunately, it appears the agency itself may have misled the public about the terms of the Equifax settlement and their ability to obtain the full reimbursement to which they are entitled.”

At issue for Warren is the FTC’s statements online, which for days indicated that Americans affected by the breach could obtain identity-protection services — or “a cash payment of $125” for those who already have such services.

AD

AD

Under its settlement with state and federal regulators, Equifax must pay up to $700 million for mishandling Americans’ data, including its failures to patch known security vulnerabilities in the years leading up to one of the worst data breaches in U.S. history. But the credit-reporting bureau only had to put aside $31 million for consumers who opted for cash instead of identity-protection tools.

Given that the breach affected roughly half of all U.S. adults — and the agency witnessed immense, early interest among millions of consumers after announcing the deal — the FTC ultimately had to clarify in late July that consumers are likely to receive “nowhere near” the $125 maximum if they chose that option.

“Frankly, the free credit monitoring is worth a lot more — the market value would be hundreds of dollars a year,” the FTC warned in a blog post.

Some other state and federal regulators that brokered the $700 million settlement with Equifax had been clearer in their fine print that consumers could receive less. The FTC, however, had conflicting information on parts of its website until early August, according to Warren. “These pages did not inform consumers that the cash payment was subject to — and in fact, was very likely to be — severely reduced,” the senator said.

AD

AD