You probably won’t get $125 from the Equifax settlement

I'm not very familiar with this case, but a quick google shows me they are subject to at least two consent orders [1], [2]. The statements of the consent orders are almost identical, however the implication is that Equifax will have to persuade multiple regulators that they fulfill the conditions.

The requirements of the consent order are what you'd expect: firm up your internal controls, and do everything possible to prevent another breach. For example here's the first requirement:

"1)Within 90 days from the effective date of this ORDER, the Board shall review and approve the written risk assessment that identifies:(a)foreseeable threats and vulnerabilities to the confidentiality of personally identifiable information (PII)1;(b)the likelihood of threats;(c)the potential damage to the Company’s business operations; and(d)the safeguards and mitigating controls that address each threat and vulnerability."

So, what's going to happen is that between now and the time the consent orders are closed Equifax will spend hundreds of millions of dollars to convince the regulators that they are atoning for their sins. You will actually be able to track this in their 10Q and 10K disclosure forms. For example in their most recent quarterly filling ([3], p. 5) you can see the item Selling, general and administrative expenses at $1.3 BN compared to the same quarter in 2018 (i.e. before they entered the consent order) when it was at $0.6 BN. That's $700 MM right there. Could it be the settlement? I don't know for sure, but there's another $700 MM the quarter before ([4], p.5).

[1] https://www.sec.gov/Archives/edgar/data/33185/00011931251820...

[2] https://dbf.georgia.gov/sites/dbf.georgia.gov/files/related_...

[3] https://otp.tools.investis.com/clients/us/equifax/SEC/sec-sh...

[4] https://otp.tools.investis.com/clients/us/equifax/SEC/sec-sh...

The company has to spend at least $1 billion on cybersecurity measures over the next five years.

Even in Europe, with the draconian GDPR rules, credit reference agencies managed to write themselves a loophole in the law ('fraud prevention' is an excuse to hold data forever, against the will of the holder, and without their permission, or even ability to see it).

Bit sad really, considering "all banks deny me a loan, and I don't know why" is just the time you want to see the details of your credit report and correct errors.