Attorney General Curtis Hill has filed a lawsuit against Equifax seeking civil penalties, consumer restitution, costs and injunctive relief following the finance company’s massive 2017 data breach that compromised the sensitive personal information of 147.9 million Americans, including 3.9 million Hoosiers.

The data breach at Equifax, one of the world’s largest credit reporting bureaus, occurred between May 13, 2017 and July 30, 2017. The U.S. House of Representatives Committee on Oversight and Government Reform investigation concluded the breach was “entirely preventable.”

The congressional committee blamed the breach in large part on an aggressive growth strategy pursued by former Equifax CEO Richard Smith. Under Smith’s leadership, the committee concluded, Equifax acquired “multiple companies, information technology systems, and data  that brought increasing complexity to Equifax’s IT systems, and expanded data security risks.”

During this time, the lawsuit states the company also pursued aggressive cost-cutting measures that included the outsourcing of some of the company’s mission-critical systems. To save expenses, the outsourcing contracts understaffed vital functions, and the service level agreements contained in the contracts focused entirely on revenue enhancing metrics such as maintaining uptime. These agreements either ignored patching and vulnerability remediation or treated those responsibilities as relatively unimportant.