"In all of our years investigating data breaches, this may be the most brazen failure to protect consumer data we have ever seen," Healey said in a statement.
Equifax had initially appeared to offer credit monitoring to breach victims only if they forfeited their right to file a lawsuit. New York Attorney General A.G. Schneiderman said Tuesday that Equifax removed that language from its website.
U.S. Treasury Secretary Steve Mnuchin on Tuesday called the Equifax breach "quite unfortunate" and insisted that his top priority is to make sure financial data is safe.
"I am concerned about the global financial system and keeping it safe," he said at the CNBC Institutional Investor Delivering Alpha Conference in New York.
Equifax did not respond to Reuters requests for comment.
This article was provided by Reuters.