NOTES TO CONSOLIDATED FINANCIAL STATEMENTS Litigation, Claims and Government Investigations.   In fiscal 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of certain personally identifiable information of U.S., Canadian and U.K. consumers. Following the 2017 cybersecurity incident, hundreds of class actions and other lawsuits were filed against us typically alleging harm from the incident and seeking various remedies, including monetary and injunctive relief. We were also subject to investigations and inquiries by federal, state and foreign governmental agencies and officials regarding the 2017 cybersecurity incident and related matters. Most of these lawsuits and government investigations have concluded or been resolved, including pursuant to the settlement agreements described below, while others remain ongoing. The Company’s participation in these settlements does not constitute an admission by the Company of any fault or liability, and the Company does not admit fault or liability. Consumer Settlement.  On July 19, 2019 and July 22, 2019, we entered into multiple agreements that resolve the U.S. consolidated consumer class action cases, captioned In re: Equifax, Inc. Customer Data Security Breach Litigation, MDL No. 2800 (the “U.S. Consumer MDL Litigation”), and the investigations of the FTC, the CFPB, the Attorneys General of 48 states, the District of Columbia and Puerto Rico (the "MSAG Group") and the NYDFS (collectively, the “Consumer Settlement”). Under the terms of the Consumer Settlement, the Company will contribute $380.5 million to a non- reversionary settlement fund (the “Consumer Restitution Fund”) to provide restitution for U.S. consumers identified by the Company whose personal information was compromised as a result of the 2017 cybersecurity incident as well as to pay reasonable attorneys’ fees and reasonable costs and expenses for the plaintiffs’ counsel in the U.S. Consumer MDL Litigation (not to exceed $80.5 million), settlement administration costs and notice costs. The Company has agreed to contribute up to an additional $125.0 million to the Consumer Restitution Fund to cover certain unreimbursed costs and expenditures incurred by affected U.S. consumers in the event the $380.5 million in the Consumer Restitution Fund is exhausted. The Company also agreed to various business practice commitments related to consumer assistance and its information security program, including conducting third party assessments of its information security program. On January 13, 2020, the Northern District of Georgia, the U.S. District Court overseeing centralized pre-trial proceedings for the U.S. Consumer MDL Litigation and numerous other federal court actions relating to the 2017 cybersecurity incident (the “MDL Court”), entered an order granting final approval of the settlement in connection with the U.S. Consumer MDL Litigation. The MDL Court entered an amended order granting final approval of the settlement on March 17, 2020. Several objectors have appealed the final approval order. Until the appeals are finally adjudicated or dismissed and the settlement becomes final in accordance with its terms, we can provide no assurance that the U.S. Consumer MDL Litigation will be resolved as contemplated by the settlement agreement. If the Court’s order approving the settlement agreement was overturned by an appellate court and not cured in accordance with the terms of the consent orders with the FTC and CFPB, the consent orders with the FTC, CFPB and MSAG Group would remain in place and the Consumer Restitution Fund would be administered by the FTC. In that event, there is a risk that we would not be able to settle the U.S. Consumer MDL Litigation on acceptable terms or at all, which could have a material adverse effect on our financial condition. Other Settlements.  Financial Institutions MDL Class Action. On May 15, 2020, the Company entered into a settlement agreement to resolve the consolidated financial institutions class action cases pending before the MDL Court (the “Financial Institutions MDL Litigation”). Under the settlement, the Company agreed to pay for valid claims submitted by class members up to a maximum amount, reasonable settlement administration and notice costs, and reasonable attorneys’ fees and expenses. The Company also agreed to adopt and/or maintain certain business practices related to its information security program. The court granted final approval of the settlement on October 22, 2020. Other Matters . We face other lawsuits and government investigations related to the 2017 cybersecurity incident that have not yet been concluded or resolved. These ongoing matters may result in judgments, fines or penalties, settlements or other relief. We dispute the allegations in the remaining lawsuits and intend to defend against such claims. Set forth below are descriptions of the main categories of these matters. 86 Product Liability. As a result of the 2017 cybersecurity incident, we offered TrustedID Premier, a credit file monitoring and identity theft protection product, for free to all eligible U.S. consumers who signed up through January 31, 2018. In late 2018, the Company extended the free credit monitoring services for an additional twelve months for eligible consumers impacted by the 2017 cybersecurity incident by providing them the opportunity to enroll in Experian IDNotify™ at no cost. We also provided free credit reports and scores, credit monitoring and identity theft protection for twenty four months to impacted consumers in Canada and the U.K. We have recorded the expenses necessary to provide this service to those who signed up. The remaining product liability balance at December 31, 2020 and 2019 was not material to the Consolidated Financial Statements. ® ®