Equifax, a consumer reporting agency at fault in a data breach affecting more than half of the U.S. population, including 500,000 Rhode Islanders, will provide up to $425 million in restitution to consumers across the country and also pay $1 million to the state of Rhode Island, according to Rhode Island Attorney General Peter F. Neronha.

The creation of a restitution fund for consumers is among the terms of a settlement that Equifax has reached with a coalition of all 50 attorneys general.

A multi-state investigation launched by the group found that Equifax failed to maintain a reasonable security system, leaving consumers’ personal information vulnerable to hackers, according to federal prosecutors.

The probe got rolling soon after Equifax disclosed a data breach in September 2017. It found that Equifax knew about a weakness in its software, failed to fully patch the system and also properly monitor its network for suspicious activity, which meant that the hackers’ penetration of the system went unnoticed for 76 days, say prosecutors.

The hacked information included social security numbers, names, dates of birth, addresses, credit card numbers, and some driver’s license numbers.

“This is an important win for consumers,” Neronha said in a news release. “As sensitive data becomes more and more vulnerable to online hackers, the need for adequate security systems and privacy measures is paramount. Our Office will continue to stand up for Rhode Island consumers.”

Under the agreement, Equifax must assist consumers affected by the breach and strengthen its security practices going forward.

The settlement is subject to court approval.

Rhode Island consumers can call the attorney general’s consumer protection unit at (401) 274-4400 to make arrangements to receive notification when the settlement receives approval. At that point, consumers will be able to file a claim online or by mail.