After the breach, Equifax now faces the lawsuits

Equifax's stock price has fallen 27 per cent since it announced the hack. Photo / AP

Since it announced a massive data breach earlier this month, Equifax has been hit with dozens of lawsuits from shareholders, consumers and now one filed by a small US credit union that represents what could be the first by a financial institution attempting to preemptively recoup losses caused by alleged fraud the hack could cause.

Equifax has said its breach exposed sensitive information about 143 million consumers, including Social Security and driver's license numbers. This kind of data could be used for identity theft and to create fake accounts, experts have said.

In the lawsuit, which seeks class action status, Madison-based Summit Credit Union says that financial institutions will have to bear the cost of cancelling and reissuing credit cards as well as absorbing the cost of any fraudulent charges.

They will also lose "profits because their members or customers were unwilling or unable to use their credit cards following the breach," according to the lawsuit.

"For financial institutions it is important they bear the financial responsibility for identity theft," said Summit's attorney Stacey Slaughter of the law firm Robins Kaplan. "All of the components that would allow someone to create a new identity" were exposed in the Equifax hack.

Equifax has said it did its best to respond to the breach and alerted consumers as quickly as it could. "We cannot comment on pending litigation, but we remain focused on helping our customers, as well as their employees and consumers, to navigate this situation," Equifax said in a statement.

After large-scale breaches, these types of lawsuits can be among the costliest. After Target's massive hack in 2013, the retailer agreed to pay $39.4 million to resolve claims by banks and credit unions and agreed to pay Visa card issuers as much as $67 million. It reached a $10 million settlement with shoppers.

But it poses a particular challenge for Equifax, a credit reporting company that has a close relationship with banks and mortgage lenders. These financial institutions share information with Equifax that is then used to compile credit reports on millions of consumers. The banks buy those reports to help them determine who to lend money or extend credit to.

Judging consumers' "credit worthiness is an important thing, a core function of financial institutions," said Brian Gudmundson, a partner at Zimmerman Reed in Minneapolis. Gudmundson, whose firm has represented financial institutions that sued Target, Home Depot and other retailers after other major hacks, said he plans to file against suit Equifax on behalf of several banks soon.

Equifax is also facing growing troubles on Capitol Hill. The company's chief executive, Richard Smith, is scheduled to testify before a House and Senate committee in October. And US Senator Elizabeth Warren has launched an inquiry into the breach and introduced legislation that would allow consumers to freeze and unfreeze their credit for free.

The company's stock price has fallen 27 per cent since it announced the hack.