By Jonathan Stempel
(Reuters) - Seven hours is all it took for Equifax Inc (N:EFX) to be hit with two lawsuits over a hacking that may have compromised personal information for 143 million American consumers.
It could take years for the credit reporting company to end the legal fallout from the unprecedented breach.
"Damages to the class are limited only to the imagination of thieves," John Yanchunis, a lawyer at Morgan & Morgan who filed one of the lawsuits, in Atlanta federal court, said in an interview on Friday. "This could be the gift that keeps on giving for years."
The lawsuits were filed on behalf of consumers accusing Equifax of negligence, or willful misconduct, in failing to properly safeguard Social Security and driver's license numbers, birth dates, addresses and sometimes credit card data.
More lawsuits are expected on behalf of shareholders.
They could claim that Equifax's stock price was inflated because the company, executives and directors defrauded them about Equifax's ability to protect data, and should not have waited until Sept. 7 to disclose a hacking uncovered on July 29.
Some lawsuits could also target sales by three Equifax executives of nearly $1.8 million of stock within a few days of the breach's discovery. Equifax has said they did not know about the breach when making their sales, which were not prearranged.
Law firm Hagens Berman said on Friday it was investigating the share sales, as well as unusual option trading activity.
Equifax options drew an unusually large trade on August 21, when 2,500 put options betting on Equifax shares dipping below $135 by September 15, traded for a total price of about $181,000.
On paper, these puts were worth about $2.73 million in late afternoon trading on Friday, according to Thomson Reuters data.
Buying of put options conveys the right to sell shares at a fixed price in the future and indicates a bearish bias, while selling puts would imply a bullish outlook.
While the size of the trade was far in excess of the stock's average daily trading volume of less than 50 contracts a day, it was not immediately clear whether the trader bought or sold these options.
"We're focused on what appears to be suspiciously timed insider selling within two trading days after the Company says it discovered the breach, the option activity and why management took so long to inform investors of the breach," said Hagens Berman partner Reed Kathrein in a statement.
Congress, and regulators like the attorneys general of New York and Illinois, are also probing the breach.
Equifax handles data on more than 820 million consumers and 91 million businesses worldwide.
"There's a panoply of things Equifax will face," said Timothy Pestotnik, a San Diego lawyer who works on class actions and was involved in litigation against Toyota over unintended vehicle acceleration. "It will require a lot of lawyers."
Equifax did not immediately respond to requests for comment. Its stock price fell as much as 17.8 percent on Friday, wiping out more than $3 billion of market value.
AVALANCHE
Many private lawsuits raising similar claims against Equifax will likely be merged by a federal judicial panel into so-called multidistrict litigation before a single judge.
Such litigation reduces the potential for conflicting rulings and unnecessary legal costs, and is often conducted in a court near a defendant's headquarters, or which has familiarity with similar lawsuits.
Those factors make the federal court in Atlanta a possible home for Equifax litigation.
Equifax is based in that city, and the court handled nationwide litigation over a 2014 breach at Atlanta-based Home Depot Inc (N:HD) affecting more than 50 million cardholders.
Plaintiffs might also prefer Atlanta because, unlike in some courts, they would not need to show thieves actually used their stolen data. The initial theft should be enough to confer legal standing.
"There will be an avalanche of consumer cases," said Yanchunis, who also leads litigation in California against Yahoo (NASDAQ:AABA) over hackings affecting more than 1 billion users, though involving less sensitive data.
"It's a better than educated guess the cases will be centralized in Atlanta."
Pestotnik said Equifax can also aid its own cause.
"To the extent Equifax can be as fulsome as possible in its disclosures, it will also help," he said. "Some companies have gone slowly, and lived to regret that."