 Alright, good morning and welcome to the University of Vermont. We are here at UVM because the Attorney General's Consumer Assistant Program is part of the University of Vermont. It's been a great partnership for the last 30 years and it really was the Consumer Assistance Program that dealt firsthand with the Equifax breach that occurred in September of 2017. We are here to announce a national settlement and what Vermont's share of that settlement is regarding the Equifax breach that occurred in September of 2017. I'm Attorney General TJ Dunham and joined with me this morning is Charity Clark, my Chief of Staff, Chris Curtis, the Chief of our Public Protection Division, Ryan Krieger, who was the attorney who worked on this national settlement, Crystal Baldwin from our Consumer Assistance Program and members of our Consumer Assistance Program. When the Equifax breach happened in September of 2017, the phones at cap did not stop ringing. 251,000 Vermonters were affected as a result of the Equifax breach. 148 million Americans were affected as a result of the Equifax breach. All consumers had their social security numbers, their birth data, and their address information compromised. Some consumers had their driver license, credit card numbers, and some credit dispute documents were jeopardized. When that breach became public, our Consumer Assistance Program worked around the clock taking phone calls from Vermonters. We received over 700 phone calls that first weekend because people, Vermonters, were rightfully scared. When you're talking about a data breach, you're talking about a higher risk of identity theft, you're talking about a higher risk of being scammed. The bottom line is this, because of this data breach, Vermonters felt anxious, scared that their financial livelihood was on the line. They rightfully should have been scared. We are in the online digital global economy, scams are on the rise, this Equifax breach demonstrated that. That's why we joined with our colleagues around this country to hold Equifax responsible. And I'm happy to announce today that Vermon is part of a national settlement which will total close to $650 million. Let me give you the breakdown of that money. And the most important part of this is about the consumers who were affected. $425 million will go towards a restitution fund. And I'm going to talk about that more in a minute. $175 million will go to the states. Between $50 to $100 million will go to the Federal Consumer Financial Protection Bureau. Out of the $175 million to the states, the state of Vermont will receive $1.85 million. Those funds will go into our state's general fund. As I said, we had 251,000 consumers impacted out of 139 million consumers nationwide that were covered in this settlement. That is 0.18% of consumers and that equals our share in terms of the settlement. The effective date of this payment is August 22, 2019. The payment will be made within 30 days of the effective date. Now regarding the restitution fund, $300 million is guaranteed payment that must be paid to consumers. That means Vermoners. How do you make yourself eligible and what is eligible in terms of the restitution? Here's the quick part. Many consumers spend a lot of time on the phone making sure that their money was safe. Consumers can submit claims for time spent dealing with this breach. If you spend any time dealing with this breach, you're eligible for $25 per hour up to 20 hours for time spent dealing with a breach. On the phone, calling us, talking to your bank, freezing your credit. If Vermoners spent time making sure that their money was safe, you are eligible for restitution up to 20 hours at $25 an hour. Secondly, if you have documented out-of-pocket expenses, and we're going to talk more about that later, you're going to be eligible up to reimbursement of up to $20,000. Everybody will be eligible if you're an effective consumer for three credit monitoring for affected consumers. If you don't like one of the three options in terms of the credit monitoring, consumers can opt for a cash payment and use it to purchase credit monitoring from another vendor. As I said, those out-of-pocket expenses like freezes or credit monitoring purchased apart from Equifax's offer are reimbursable. If that $300 million is exhausted, that additional $125 million in funds will become payable if the original fund amount is exhausted. In terms of the monitoring services, for adults, you will have free, free Bureau of Credit Monitoring for up to four years. The monitoring will include a $1 million identity theft insurance policy. After those three Bureau of Monitoring expenses expires, consumers will get one Bureau of Monitoring for six more years. And if you're a minor, if you're a kid, you'll have free 18 years of credit monitoring, four years plus 14 years for one Bureau of Monitoring, two free credit reports every 12 months for five years, and Equifax won't charge anyone for credit freezes or any of the earlier breach responses and no upselling to other services. This is a good settlement for Vermonters. This is good for consumers. But most importantly, what this breach did was to raise awareness about online security. But as I said, we live in a global digital economy. More and more of our financial attractions are being done online. That raises the risk level for scams and for these breaches. Vermont has one of the strongest and most robust data breach notification laws in the country. That's a good thing. Why we have that is so we can protect consumers, so we can tell consumers when their money is at risk. And we are in a world where people have anxiety and angst and uncertainty about their financial futures. We have to do everything we can as a state to protect them. And given Vermonters, the knowledge, the information, and the tools to protect their money, their retirement, and their livelihood is good consumer protection. That's what this settlement does today. That's why I'm proud to be a member of this national settlement to bring this money back to the state of Vermont. And more importantly, to open up avenues so Vermonters who are affected can get paid back for the time they spent making sure that their money was safe. With that, let me turn it over to Chris Curtis, the chief of my public protection division, Chris. Great. Thank you, General Donovan. Again, my name is Chris Curtis. I'm chief of the public protection division at the office of the attorney general. I want to invite Ryan Krieger, one of my colleagues and our assistant attorney general who worked on this matter for our office to the podium. Ryan has done an outstanding job. And I also want to thank Crystal Baldwin and our entire consumer assistance program team for all of the work that they have done to reassure Vermonters in the wake of this day to breach and others. When these things happen, this office is responsive. And General Donovan has made this issue a top priority for our office. And Vermonters should know that we've redoubled our efforts with respect to data privacy, consumer privacy, security breach, all of our outreach efforts in this area. And the attorney general has made that a priority for our office. The truth is the future of consumer protection is online. We have a long and historic tradition in the state of Vermont of protecting consumers. And many of those laws are responsive to the face-to-face transaction, the Vermont handshake, the understanding between parties. But increasingly, we live in a wired world and those transactions are happening in cyberspace. So it is crucially important that this office be responsive and be bold in making sure that there is accountability, there's transparency, and that there is an effort with respect to both our education and outreach efforts and our public policy initiatives, that those are reflected in this office. And that's what Attorney General Donovan has done. And that's in part what this settlement is helping to do as well. It's a broad recognition, almost an endorsement of the efforts of this office in that area, that we are going to make sure that Vermonters feel secure and that when there's a breach, there is accountability, that there's restitution available for Vermonters, as in this case, where it's warranted, and that we can have preventive measures in the future, so ongoing credit monitoring. All of those security measures that will be in place for affected Vermonters going forward, critically important. I want to note that two years ago, when news of this massive breach broke, not only did the Consumer Assistance Program triage, in fact, our entire office, we had attorneys taking calls from consumers that were alarmed, hundreds and hundreds of telephone calls from concerned Vermonters all across the state. But that wasn't enough. The Attorney General directed our office to work with our partners in the legislature to have community meetings. We went to Barton, to Springfield, to Bennington, to Burlington, all over the state to convene community meetings to address Vermonters face to face and tell them what they could do to take steps to protect themselves, how to prevent identity theft from happening, how to secure a credit freeze on their accounts. And even that wasn't enough because, subsequently, we worked with our partners in the legislature to make sure that Vermont eliminated fees to place security freezes on their credit files so that no Vermonter would have to pay to put a freeze on their credit so that they can help protect their identities at no cost to themselves. That obviously was a law that took effect going forward in time. So for Vermonters that heard about the news and immediately acted to protect themselves, they may have incurred costs. Another reason why this settlement is so important, so they can get reimbursed for those costs that they may have incurred. So this is a crucially important settlement. It's going to have, I think, major importance across the country for consumers, for federal agencies, and of course for our state. And we're very pleased to be part of this today. I wanted to, Ryan, if there's anything you want to add vis-a-vis our outreach efforts or with respect to, oh, I do want to note that Attorney Krieger has done an amazing job of helping us to facilitate working group proposals, both as to privacy matters, along with our Chief of Staff, Charity Clark, they have spearheaded the effort on privacy working group. There is a bill pending in the legislature on additional privacy measures in the future that may help to ameliorate some of these kinds of issues in the future. And of course, we had a data broker working group that resulted in the nation's first data broker registration law. So all of these activities are part and parcel of this new frontier, new online consumer protections. Our office is proud to be a part of it, and we're proud to get this matter resolved for Vermonters today. And with that, I want to open it up to our Chief of Staff, Charity Clark, and she can share with you what Vermonters can do to better protect themselves. All right. So as Chief of Staff, one of my responsibilities is that I'm lucky enough to oversee the Consumer Assistance Program, which is located here at UVM. And they have, I want to reiterate what others have said. They did a phenomenal job in the aftermath of the breach of being available to Vermonters. They had a website up literally the first day. People didn't know where to turn, and they knew in Vermont, because we were so responsive. So I was very proud of that. I thought it would be helpful if I shared some tips about identity theft. And I also, the Consumer Assistance Program, brought these handy-dandy brochures for you that can help with a recovery plan if you do have an identity theft situation on your hands. These are free from the FDC, so we have a bunch. I'll pass them out, because they really have a lot of great information. And let me say what some of those tips are. So the first step is we should all be revealing our credit report every year. You can get a free credit report going to annualcreditreport.com. And just looking it over and making sure there's no inaccuracies or suspicious activity. When I'm talking about suspicious activity, I'm talking about things like credit card accounts that you did not open, address changes that you can initiate, loans that you did not take out, things like that. And if you do find suspicious activity on your credit report, there are recommended steps to take. The first thing that you should do is call the company where the fraud occurred to let them know I did not open up this credit card account. I need to close it and let them know that you believe you may be the victim of identity theft. You should change your password, your logins, your pin numbers. And then contact the credit reporting agencies to ask for a correction to your credit report. And the FTC is incredibly helpful. Not only do they have this brochure, but you can go online at identitytheft.gov, identitytheft.gov. And they will walk you through a plan that would work best for you. Some of the other things that might be recommended are to put a fraud alert on your credit report. That means that when someone is looking something up, it will kind of have a red flag on it to alert them. You know, this person may have been the victim of identity theft, so just be careful here. And you can also freeze your credit. That used to cost money and it doesn't anymore. So you can freeze your credit and unfreeze it without paying anything. So that's available as well. And the other step that we always recommend at CAP when folks call is to contact your local police and make a report of identity theft. You can use the police report that you'll fill out. If you need it down the road, you might need to demonstrate to someone, this happened to me, and you can have that in your file. With all of this, with identity theft, be sure to keep really good records, keep a file and who you talk to and when, and it'll help you as you move forward. So those are just some of the resources that we wanted to bring to your attention. And like I said, I can pass these out if there are any used to you. So thanks so much. Thank you. Thank you, Charity. So here's, this is where we need your help. How do Vermonters get their money? Here's the website. Equifaxbreachsettlement.com. This is going to be the website, Equifaxbreachsettlement.com, where Vermonters will go to submit their claims, whether it's for the time spent, again, 25 bucks per hour, up to 20 hours, for just time spent. Equifaxbreachsettlement.com. Secondly, if you have those out-of-pockets losses, Equifaxbreachsettlement.com. If you have out-of-pocket losses, it's up to $20,000 reimbursable. So those are the big two, restitution issues for Vermonters to be paid back. You got to submit a claim in addition to that, the three credit monitoring services that will be provided to all affected consumers. So please get this website out and Vermonters should go to Equifaxbreachsettlement.com. I don't want to confuse matters, but there's another website too. The FTC, just explain what that is, Ryan, please. So the Federal Trade Commission has set up, the Federal Trade Commission was one of the parties in this settlement. They have set up a website. All you have to do is Google FTC EquifaxSettlement and it's going to be the first thing that comes up. That's probably the easiest way to get there. And on that website, there is a link that you can click on and you will get email updates regarding the settlement. That's important because on that Equifaxbreachsettlement.com, there is a judge in Atlanta that needs to approve this settlement and once that approval comes through, some of the things on the Breachsettlement website will go live that might not be live right now. So if people go immediately to that website, they might not be able to take advantage of all the other things. We suspect that within a week, everything will be live on that website. Thank you. Okay, so to get updates, the FTC website to submit your claim is going to be EquifaxSettlement... Equifaxbreachsettlement.com. If our partners in the media could put that information out, we would appreciate that. So with that, let me just again make my team. I want to thank our partnership with the University of Vermont. I want to thank the students at UVM who were on the phones talking to Vermonters. It is a great testament to the quality of students here at the University of Vermont and to the institution itself for having such mature, responsible young professionals that the Attorney General's office relies on to handle consumer issues. I just want to say this about CAP. 13,000 calls a year we get from the Consumer Assistance Program from Vermonters. I think we're the only place in state government where you actually get a real live person on the phone. That's why we get so many calls. We're not going to be able to answer every question, but we do our best to navigate the bureaucracy of state government to get information to Vermonters to solve their problems. That's how government should work. That's what we're doing here at the Attorney General's office, working with UVM and working with our CAP program. So with that, let me conclude and open it up for any questions. Joe. You said, what, 256,000 Vermonters? That's your average? 251. The exact number is this. 251,419. 251,419 Vermonters were affected. 148 million total Americans. So I'm trying to do my math here. It comes to like $7 a person. Your math has been in the mind, Joe. I can't. Do you think that's enough? Yeah. Yeah. I think when you are part of a national settlement, which we are in this case, and we are in many other cases historically as well, it comes down to an equation in order to try to bring about fairness and population and the number of affected consumers is always going to be part of that equation. So I think the exact math, and I may be wrong about this, but this is what I have. 251,000 consumers impacted out of 139 million consumers is .18 of consumers. And our share of the penalties is about 1%, 1.05%. So that's the ballpark, and I think the math does work on that. When you're in these national settlements, it comes down to the affected consumers' population, and it's always going to be an equation. What did actual facts do wrong? Was it local? Was it accident or local? I'm going to ask Ryan Krieger to explain that and to talk also about I think the importance of our data notification security law. Sure. So the key thing that Equifax did wrong was not having sufficient data security. And that is often the case when we see these data breaches. It is possible to have a data breach and still have done everything within your power. The bad guys are often just that good. That was not the case here. Equifax had some pretty bad data security. In particular, there was a vulnerability called the Struts vulnerability. It was a known vulnerability that Equifax should have patched. They did not patch it. The bad guys were able to get to a database by logging in through the internet. It was a database with a lot of data that probably should not have been easily accessible from the internet. And another really important part of this settlement is there is an entire data security regime that Equifax is going to have to implement in order to comply with this settlement. So they have to have much better data security. And is it so true two years later that no one has been proven to be exposed and not exposed? But there has been no actual damage yet. These stolen files have not been used yet, is that correct? That is really hard to say. I don't know that the files have been, say, dumped onto the dark web for purchase. That doesn't necessarily mean that they're not being used. Identity theft happens all the time. Were the bad guys using this tranche of data to do that? It's hard to sometimes tie an individual ID theft to an individual harm, although in this case, if someone was affected by the breach and they did suffer ID theft, they will be able to submit receipts to try to get remersed. What were the hacks? I don't know that they were identified. We don't know. I don't believe so. I can look into that deeper and get back to you afterwards, but I'm not sure they were identified. Do you have to do anything to sign up for the 10 years of free, better monitoring? You are going to have to go to the Equifax breach settlement website. You're going to ask for it? Yes. How do you sort it last time? K-R-I-G-E-R. I do want to, I know that there was a mention of the FTC website. One benefit of going to that website, and it is just, it's very simple. It's ftc.gov backslash Equifax. So if you can put that out there as well, consumers can sign up today to get e-mail alerts so that when the National Claims Administrator website goes live or portions of that start to go live, they can get e-mail notifications through the FTC that that's happening. So that is one action step that a consumer could take today so that even if the settlement website isn't fully up and running until after the orders are approved and so on and so forth, the FTC will keep people updated. So if you want to know and not have to be checking back yourself every day on that website or looking for the news about when the settlement is approved, you can sign up for the FTC, through the FTC website for e-mail updates and alerts that will keep you apprised as the process unfolds. The judge's decision to take a plan, when will the plan start? It's impossible to say for sure we are hoping and suspecting that within a few days it will come down. Well, I'm going to conclude the press conference where I file a consumer complaint because of the paint fumes in the room. But with that, there's no other questions. Thanks for coming. Appreciate it.