Item 3. LEGAL PROCEEDINGS

Remaining Matters Related to 2017 Cybersecurity Incident

Canadian Class Actions. Five putative Canadian class actions, four of which are on behalf of a national class of approximately 19,000 Canadian consumers, are pending against us in Ontario, British Columbia and Alberta. Each of the proposed Canadian class actions asserts a number of common law and statutory claims seeking monetary damages and other related relief in connection with a material cybersecurity incident in 2017. In addition to seeking class certification on behalf of Canadian consumers whose personal information was allegedly impacted by the 2017 cybersecurity incident, in some cases, plaintiffs also seek class certification on behalf of a larger group of Canadian consumers who had contracts for subscription products with Equifax around the time of the incident or earlier and were not impacted by the incident. The Ontario class action has been certified in part but is otherwise at a preliminary stage. All other purported class actions are at preliminary stages or stayed.

CFPB Matters

In December 2021, we received a Civil Investigative Demand (a “CID”) from the CFPB as part of its investigation into our consumer disputes process at our USIS business unit in order to determine whether we have followed FCRA requirements for the proper handling of consumer disputes. The CID requested the production of documents and answers to written questions. In January 2023, the CFPB informed us that its enforcement division would be investigating our previously-disclosed coding issue identified within a legacy server environment in the U.S. that impacted how some credit scores were calculated during a three-week period in 2022. In January 2025, we entered into a consent order with the CFPB to settle the investigation into our consumer disputes process at our USIS business unit and the investigation into our previously-disclosed coding issue. The consent order resolves these investigations and requires the payment of a civil money penalty of $15 million. As part of the settlement, the Company has agreed to modify certain business practices.

In July 2023, we received a CID from the CFPB as part of its investigation into data accuracy and dispute handling at our Workforce Solutions business unit in order to determine whether we have followed the FCRA's requirements. We received a second CID from the CFPB in March 2024 and a third CID from the CFPB in August 2024 as part of the same investigation. The CIDs request the production of documents and answers to written questions. We are cooperating with the CFPB in its investigation and providing responses and information on an ongoing basis. At this time, we are unable to predict the outcome of this CFPB investigation, including whether the investigation will result in any actions or proceedings against us.

Other

Equifax has been named as a defendant in various other legal actions, including administrative claims, regulatory matters, government investigations, class actions and other litigation arising in connection with our business. Some of the legal actions include claims for substantial compensatory or punitive damages or claims for indeterminate amounts of damages. We believe we have defenses to and, where appropriate, will contest many of these matters. Given the number of these matters, some are likely to result in adverse judgments, penalties, injunctions, fines or other relief. We may explore potential settlements before a case is taken through trial because of the uncertainty and risks inherent in the litigation process.

For information regarding our accounting for legal contingencies, see Note 6 of the Notes to Consolidated Financial Statements in Item 8 of this report.