Item 3. LEGAL PROCEEDINGS

Litigation and Investigations related to the 2017 Cybersecurity Incident

Since the 2017 cybersecurity incident, hundreds of class actions and other lawsuits have been filed against us typically alleging harm from the 2017 cybersecurity incident and seeking various remedies, including monetary and injunctive relief. We dispute the allegations in the complaints described below and intend to defend against such claims. In addition, numerous governmental agencies are investigating us in connection with the 2017 cybersecurity incident, which may result in fines, settlements or other relief. Set forth below are descriptions of the main categories of these lawsuits and investigations.

Multidistrict Litigation. Hundreds of class actions were filed against us in federal and state courts relating to the 2017 cybersecurity incident. The plaintiffs in these cases, who purport to represent various classes of U.S. consumers and small businesses, generally claim to have been harmed by alleged actions and/or omissions by Equifax in connection with the 2017 cybersecurity incident and assert a variety of common law and statutory claims seeking monetary damages, injunctive relief and other related relief.

In addition, certain class actions have been filed by financial institutions that allege their businesses have been placed at risk due to the 2017 cybersecurity incident and generally assert various common law claims such as claims for negligence and breach of contract, as well as, in some cases, statutory claims. The financial institution class actions seek compensatory damages, injunctive relief and other related relief.

Furthermore, a lawsuit has been filed against us by the City of Chicago with respect to the 2017 cybersecurity incident alleging violations of state laws and local ordinances governing protection of personal data, consumer fraud, breach notice requirements and business practices and seeking declaratory and injunctive relief and the imposition of fines the aggregate amount of which the complaint does not specifically quantify. Three Indian Tribes filed suits in federal court asserting putative class actions relating to the 2017 cybersecurity incident brought on behalf of themselves and other similarly situated federally recognized Indian Tribes and Nations. Additionally, the Commonwealth of Puerto Rico filed an action on its own behalf and on behalf of the people of Puerto Rico arising out of the 2017 cybersecurity incident.

Beginning on December 6, 2017 and pursuant to multiple subsequent orders, the U.S. Judicial Panel on Multidistrict Litigation ordered the consolidation and transfer for pre-trial proceedings with respect to the U.S. cases pending in federal court discussed above, including the City of Chicago action, the Indian Tribal suits, and the Puerto Rico action, to the Northern District of Georgia as the single U.S. District Court for centralized pre-trial proceedings (the “MDL Court”). Based on these orders, consolidated proceedings with respect to U.S. consumer and financial institution federal class actions and other lawsuits related to the 2017 cybersecurity incident have been conducted in the MDL Court. The MDL Court has established separate tracks for the consumer and financial institution class action cases and appointed lead counsel on behalf of plaintiffs in both tracks. Certain individual plaintiffs with cases pending in the MDL consolidated proceedings, including Puerto Rico and the City of Chicago, have sought the establishment of additional tracks and other related relief. The MDL Court has not yet ruled on those requests.

The Company moved to dismiss the consolidated class action complaints filed by the U.S. consumer, small business and financial institution plaintiffs in their entirety. On January 28, 2019, the MDL Court dismissed the small businesses’ consolidated class action complaint in its entirety. The MDL Court dismissed certain claims brought by the consumer and financial institution plaintiffs, while allowing other claims by those plaintiffs to proceed. Pursuant to case management orders issued by the MDL Court, consolidated pre-trial proceedings, including discovery between the parties, will proceed on the remaining claims of the U.S. consumer and financial institution plaintiffs.

Georgia State Court Consumer Class Actions. Four putative class actions arising from the 2017 cybersecurity incident were filed against us in Fulton County Superior Court and Fulton County State Court in Georgia based on similar allegations and theories as alleged in the U.S. consumer class actions pending in the MDL Court and seek monetary damages, injunctive relief and other related relief on behalf of Georgia citizens. These cases have been transferred to a single judge in the Fulton County Business Court and three of the cases were consolidated into a single action. On July 27, 2018, the Fulton County Business Court granted the Company’s motion to stay the remaining single case, and on August 17, 2018, the Fulton County Business Court granted the Company’s motion to stay the consolidated case.

Canadian Class Actions. Seven Canadian class actions, five of which are on behalf of a national class of approximately 19,000 Canadian consumers, have been filed against us in Ontario, Saskatchewan, Quebec and British Columbia. Each of the proposed Canadian class actions asserts a number of common law and statutory claims seeking monetary damages and other related relief in connection with the 2017 cybersecurity incident. The plaintiffs in each case seek

class certification/authorization on behalf of Canadian consumers whose personal information was allegedly impacted by the 2017 cybersecurity incident. In some cases, plaintiffs also seek class certification on behalf of Canadian consumers who had contracts for subscription products with Equifax around the time of the incident. All purported class actions are at preliminary stages, and we are opposing class certification or authorization in cases where such motions are pending. In addition, one of the cases in Ontario as well as the Saskatchewan case have been stayed. The Court’s order staying the Saskatchewan case is on appeal.

TransUnion Litigation. On November 27, 2017, Trans Union LLC and TransUnion Interactive, Inc. (collectively, “TransUnion”) filed a lawsuit in the U.S. District Court for the Northern District of Illinois against Equifax Information Services LLC, Equifax Inc., and Equifax Consumer Services LLC f/k/a Equifax Consumer Services, Inc. In its lawsuit, TransUnion asserts claims for declaratory relief, breach of contract, and anticipatory repudiation of contract based on our Reciprocal Data Supply Agreement (the “Agreement”), which sets forth the pricing terms for credit monitoring supplied by the parties to each other. TransUnion seeks a declaration regarding its contractual rights under the Agreement and monetary damages. On January 26, 2018, we moved to dismiss TransUnion’s claims. On June 19, 2018, the court granted in part and denied in part our motion to dismiss, dismissing Equifax Inc. from the case. Discovery has now commenced and is scheduled to end in March 2019. We dispute the allegations by TransUnion and intend to defend against its claims.

Securities Class Action Litigation. A consolidated putative class action lawsuit alleging violations of various federal securities laws in connection with statements and alleged omissions regarding our cybersecurity systems and controls is pending against us and certain of our current and former executives, officers and directors in the U.S. District Court for the Northern District of Georgia. The consolidated complaint seeks certification of a class of all persons who purchased or otherwise acquired Equifax securities from February 25, 2016 through September 15, 2017 and unspecified monetary damages, costs and attorneys’ fees. The Company moved to dismiss the consolidated class action complaint in its entirety. On January 28, 2019, the court dismissed claims against certain individual defendants and claims challenging certain statements, but allowed other claims against Equifax and our former Chairman and Chief Executive Officer to proceed. Pursuant to scheduling and case management orders issued by the court, pre-trial proceedings, including discovery between the parties, will proceed on the remaining claims.

Shareholder Derivative Litigation. A consolidated putative shareholder derivative action naming certain of our current and former executives, officers and directors as defendants and naming us as a nominal defendant is pending in the U.S. District Court for the Northern District of Georgia. Among other things, the consolidated complaint alleges claims for breaches of fiduciary duties, unjust enrichment, corporate waste and insider selling by certain defendants, as well as certain claims under the federal securities laws. The complaint seeks unspecified damages on behalf of the Company, plus certain equitable relief. We have appointed a committee of independent directors empowered to evaluate and respond in our best interests to the claims and related litigation demands.

Government Lawsuits. In addition to the City of Chicago’s and Commonwealth of Puerto Rico’s lawsuits in the MDL Court, the City of San Francisco filed a lawsuit against us in Superior Court in the City of San Francisco on behalf of the People of the State of California alleging violations of California’s unfair competition law due to purported violations of statutory protections of personal data and statutory data breach requirements and seeking statutory penalties, injunctive relief, and restitution for California consumers, among other relief. The court has stayed the City of San Francisco action until March 29, 2019.

Civil enforcement actions have been filed against us by the Attorneys General of Massachusetts and West Virginia alleging violations of commonwealth/state consumer protection laws. The Massachusetts action is pending in Suffolk Superior Court and seeks permanent injunctive relief, civil penalties, restitution, disgorgement of profits, costs and attorneys’ fees. The Suffolk Superior Court denied the Company’s motions to stay and dismiss the case, and the case is in discovery. The West Virginia action is pending in the Circuit Court of Boone County and seeks civil penalties and attorneys’ fees. Equifax’s motion to stay proceedings was granted on a temporary basis on December 21, 2018, and then continued on January 24, 2019, with the court scheduling a further hearing for February 28, 2019. The lawsuit filed by the Attorney General of Puerto Rico was transferred to the MDL proceeding, as described above. The Puerto Rico Department of Consumer Affairs has issued Notices of Infraction related to the Company’s alleged failure to give timely notice of the data breach under Puerto Rico law to the Department and Puerto Rico consumers.

Individual Consumer Litigation. Over 1,000 individual consumer actions, including multi-plaintiff actions, have been filed against us in state (general jurisdiction and small claims) and federal courts across the U.S. related to the 2017 cybersecurity incident. These claims include more than 2,500 individual plaintiffs. In addition, there are approximately 50 individual arbitration claims. The plaintiffs/claimants in these cases generally claim to have been harmed by alleged actions and/or omissions by Equifax in connection with the 2017 cybersecurity incident and assert a variety of common law and

statutory claims seeking primarily monetary damages. Where possible, actions filed in federal court or removed to federal court have been noticed for transfer to the MDL Court. Some of these matters have been finally resolved, and others are in various stages.

Government Investigations. We continue to cooperate with federal, state, city and foreign governmental agencies and officials investigating or otherwise seeking information, testimony and/or documents, including through Civil Investigative Demands and subpoenas, regarding the 2017 cybersecurity incident and related matters, including 48 state Attorneys General offices, the District of Columbia, the Federal Trade Commission (“FTC”), the Consumer Financial Protection Bureau (“CFPB”), the U.S. Securities and Exchange Commission (“SEC”), the U.S. Department of Justice, other U.S. state regulators, certain Congressional committees of both the U.S. Senate and House of Representatives, the Office of the Privacy Commissioner of Canada (“OPC”) and the U.K.’s Financial Conduct Authority (“FCA”). The Financial Industry Regulatory Authority, Inc. conducted an investigation that has now been concluded.

With respect to state Attorneys General investigations, the Company is cooperating with a consolidated multi-state investigation involving the Attorneys General of 46 states and the District of Columbia. As noted above, the Attorneys General of Massachusetts, West Virginia and Puerto Rico are not participating in the multi-state process and have filed suit. The Attorneys General of Indiana and Texas are each conducting separate investigations.

The staffs of the CFPB and FTC have informed us that their respective agencies intend to seek injunctive relief damages and, with respect to the CFPB, civil money penalties against us based on allegations related to the 2017 cybersecurity incident. We have submitted written responses to the CFPB and FTC addressing their allegations, and we continue to cooperate with the agencies in their investigations. On October 2, 2018, the Enforcement Staff of the NYDFS provided us with notice that it is considering recommending that the NYDFS take legal action against us, potentially seeking consumer relief and civil money penalties. We continue to cooperate with the NYDFS in its investigation.

The staff of the OPC has informed us that the OPC intends to make certain findings and recommendations in connection with its investigation of the 2017 cybersecurity incident. We have submitted written responses to the OPC and we continue to cooperate in its investigation.

The SEC issued a subpoena on May 14, 2018 regarding disclosure issues relating to the 2017 cybersecurity incident. We continue to cooperate with the SEC in its investigation. In addition, we continue to cooperate with the SEC and the U.S. Attorney’s Office for the Northern District of Georgia regarding investigations into the trading activities by certain of our current and former employees in relation to the 2017 cybersecurity incident.

The New York State Attorney General Investor Protection Bureau (“IPB”) issued a subpoena on September 20, 2017 relating to an investigation of whether there has been a violation of the Martin Act. We continue to cooperate with the IPB in its investigation.

The FCA served an Enforcement Notice and Information Requests. We have provided responses to these requests and continue to cooperate with the FCA.

Although we are actively cooperating with the above investigations and inquiries, an adverse outcome to any such investigations and inquiries could subject us to fines or other obligations, which may have an adverse effect on how we operate our business or our results of operations.

Public Records Litigation

Equifax has been named as a defendant in 19 putative class action lawsuits pending in federal courts across the country relating to its reporting of civil judgments and tax liens on consumers’ credit files. In October 2018, Equifax and the plaintiffs’ attorneys who filed the lawsuits reached an agreement in principle to settle the public records-related claims at issue on behalf of a nationwide class of consumers and we accrued an estimate of our liability for these matters in the third quarter of 2018. The amount accrued represents our best estimate of the liability related to this matter and is not material to the Consolidated Financial Statements. The parties have filed notices of settlement in the pending lawsuits and have begun drafting a settlement agreement and preliminary approval papers to file with the requisite court. If the final terms of a settlement agreement cannot be agreed upon, or if the settlement is not ultimately approved by the court, Equifax believes it has valid defenses to each of these actions and will continue to defend against them.

ACCC Investigation

In March 2017, the Australian Competition and Consumer Commission (the “ACCC”) commenced an investigation to determine whether the Company has been or is engaged in unlawful acts or practices relating to advertising, marketing and sale of consumer reports, credit scores or credit monitoring products in violation of the Australian Consumer Law, which prohibits misleading or deceptive conduct and false representations. The ACCC issued a number of notices to produce documents and information. On March 16, 2018, the ACCC commenced proceedings against the Company. The proceedings were settled on October 2, 2018. The settlement, which is subject to final court review, requires Equifax to, among other things, pay a monetary penalty, provide refunds to certain impacted consumers and refrain from engaging in specified conduct.

California Bankruptcy Litigation

In consolidated actions filed in the U.S. District Court for the Central District of California, captioned Terri N. White, et al. v. Equifax Information Services LLC, Jose Hernandez v. Equifax Information Services LLC, Kathryn L. Pike v. Equifax Information Services LLC, and Jose L. Acosta, Jr., et al. v. Trans Union LLC, et al., plaintiffs asserted that Equifax violated federal and state law (the FCRA, the California Credit Reporting Act and the California Unfair Competition Law) by failing to follow reasonable procedures to determine whether credit accounts are discharged in bankruptcy, including the method for updating the status of an account following a bankruptcy discharge. On August 20, 2008, the District Court approved a Settlement Agreement and Release providing for certain changes in the procedures used by defendants to record discharges in bankruptcy on consumer credit files. That settlement resolved claims for injunctive relief, but not plaintiffs’ claims for damages. On May 7, 2009, the District Court issued an order preliminarily approving an agreement to settle remaining class claims. The District Court subsequently deferred final approval of the settlement and required the settling parties to send a supplemental notice to those class members who filed a claim and objected to the settlement or opted out, with the cost for the re-notice to be deducted from the plaintiffs’ counsel fee award. Mailing of the supplemental notice was completed on February 15, 2011 and the deadline for this group of settling plaintiffs to provide additional documentation to support their damage claims or to opt-out of the settlement was March 31, 2011. On July 15, 2011, the District Court approved the settlement. Several objecting plaintiffs subsequently filed notices of appeal to the U.S. Court of Appeals for the Ninth Circuit, which, on April 22, 2013, issued an order vacating the settlement and remanding the case to the District Court for further proceedings. On January 21, 2014, the District Court denied the objecting plaintiffs’ motion to disqualify counsel for the settling plaintiffs and granted the motion of counsel for the settling plaintiffs to be appointed as interim lead class counsel. On March 28, 2016, the U.S. Court of Appeals for the Ninth Circuit affirmed the District Court’s lead counsel appointment. On January 9, 2017, the United States Supreme Court denied the objectors’ Petition for a Writ of Certiorari. The parties re-engaged in settlement discussions, including participation in mediations in August 2016 and November 2016, and reached an agreement to again settle the monetary claims. Settlement documents were filed with the District Court on April 14, 2017. On June 16, 2017, the Court granted preliminary approval of the proposed settlement, conditionally certified the settlement class, and appointed class counsel and administrator. A Final Fairness Hearing was held on December 11, 2017 and on April 6, 2018, the Court granted final approval. A Notice of Appeal was filed on May 7, 2018. Following the Notice of Appeal, the parties reached a Stipulation Regarding Attorneys’ Fees and Costs with the District Court subject to affirmance of the settlement with the U.S. Court of Appeals for the Ninth Circuit. The Ninth Circuit issued a briefing schedule on July 3, 2018, and on September 17, 2018, the objectors filed their appellate brief. The settling parties filed responsive briefs on January 31, 2019.

Other

Equifax has been named as a defendant in various other legal actions, including administrative claims, regulatory matters, government investigations, class actions and other litigation arising in connection with our business. Some of the legal actions include claims for substantial compensatory or punitive damages or claims for indeterminate amounts of damages. We believe we have defenses to and, where appropriate, will contest, many of these matters. Given the number of these matters, some are likely to result in adverse judgments, penalties, injunctions, fines or other relief. We may explore potential settlements before a case is taken through trial because of the uncertainty and risks inherent in the litigation process.

For information regarding our accounting for legal contingencies, see Note 6 of the Notes to Consolidated Financial Statements in this Form 10-K.