Judge says Massachusetts can sue Equifax over breach

A Massachusetts judge has cleared the way for the state to sue Equifax over the massive data breach that the credit reporting firm disclosed last year.

Suffolk County Superior Court Judge Kenneth Salinger denied a motion by Equifax to dismiss the lawsuit brought against it by Massachusetts Attorney General Maura Healey, Reuters reports.

{mosads}

Healey, a Democrat, sued Equifax last September after the company revealed a data breach impacting more than 140 million U.S. consumers.

She alleged that the credit reporting firm ignored clear cybersecurity vulnerabilities for months and failed to safeguard personal information on nearly 3 million Massachusetts residents. She also accused the firm of waiting too long to disclose the breach.

“These allegations state a viable claim for violation of the data security regulations,” Salinger wrote in a decision made public Wednesday, according to Reuters.

Equifax first first revealed on Sept. 7 that hackers accessed personal data on as many as 143 million Americans, activity that the firm initially discovered at the end of July. The revelation prompted months of backlash in Washington, several lawsuits and an investigation by the Federal Trade Commission.

The controversy has also led U.S. lawmakers to pursue legislation that would create a federal standard for notifying the public of data breaches, though the efforts thus far have proven unsuccessful. Currently, several states including Massachusetts have their own data breach notification laws, but no federal rule exists. 

Equifax has since acknowledged that the number of impacted Americans is more than 147 million.