Business ProfileforExperian

The following describes a government action that has been resolved by either a settlement or a decision by a court or administrative agency. If the matter is being appealed, it will be noted below.

On November 7, 2022, Experian entered into an Assurance of Voluntary Compliance with the Ohio Attorney General and 39 other states. The Assurance settle claims related to the data breaches in 2012 and 2015 that compromised the personal information of millions of consumers nationwide. Under terms of the settlement, the business agreed to pay $12.67 million. The business has agreed to strengthen its data-security practices by:

-Not misrepresenting to its clients the extent to which Experian protects the privacy and security of personal information.
-Introducing a comprehensive Information Security Program, including regular executive-level reporting and enhanced employee training.
-Adopting due-diligence provisions, which means properly vetting acquisitions and evaluating data-security concerns prior to integration.
-Implementing data minimization and disposal requirements, including specific efforts aimed at reducing use of Social Security numbers as identifiers.
-Meeting specific security requirements regarding encryption, segmentation, patch management, intrusion detection, firewalls, access controls, logging and monitoring, penetration testing and risk assessments.

The settlement also requires Experian to offer five years of free credit monitoring services to affected consumers, as well as two free copies of their credit reports annually during that time. 

This action is final.