Equifax hit with first lawsuit by U.S. city over data breach

SAN FRANCISCO – San Francisco on Tuesday became the first U.S. city to sue sue Equifax (EFX) over a massive data breach that exposed the personal information of about 143 million Americans.

The city filed a lawsuit against the credit reporting company in a California court. It accuses Equifax of violating state law by failing to implement reasonable security measures and not providing timely notice of the breach.

The suit seeks tens of millions of dollars in civil penalties and restitution for some consumers.

Equifax declined to comment on the pending litigation, but says it remains focused on helping its customers.

The state of Massachusetts has also sued Equifax over the breach, and the company is facing scrutiny from Congress. 

San Francisco's lawsuit was filed on the same day that Equifax chief executive Richard Smith stepped down effective immediately.

The executive's exit is unlikely to turn down the heat on the company, with Smith still scheduled to appear before House and Senate lawmakers next week to answer question about the breach. 

The CEO's exit "doesn't change the optics of its terrible data breach and its slow, inadequate and maddening response to its consumer victims," said Ed Mierzwinski of consumer advocacy group U.S. PIRG in a statement.

The Federal Trade Commission, Securities and Exchange Commission and Consumer Federal Protection Bureau, along with the FBI and state attorneys general is at least 40 states, also are investigating Equifax breach.