I didn't really want to have to write this, but given how many readers have asked, it seemed wise to see this one through:

Millions of people likely just received an email or snail mail notice saying they’re eligible to claim a class action payment in connection with the 2017 megabreach at consumer credit bureau Equifax. Given the high volume of reader inquiries about this, it seemed worth pointing out that while this particular offer is legit (if paltry), scammers are likely to soon capitalize on public attention to the settlement money.

https://krebsonsecurity.com/2022/12/the-equifax-breach-settlement-offer-is-real-for-now/

More important, from my view anyway, is the info at the bottom of the piece:

Equifax surpassed Wall Street’s expectations in its most recent quarterly earnings: The company reported revenues of $1.24 billion for the quarter ending September 2022.

Of course, most of those earnings come from Equifax’s continued legal ability to buy and sell eye-popping amounts of financial and personal data on U.S. consumers. As one of the three major credit bureaus, Equifax collects and packages information about your credit, salary, and employment history. It tracks how many credit cards you have, how much money you owe, and how you pay your bills. Each company creates a credit report about you, and then sells this report to businesses who are deciding whether to give you credit.

Americans currently have no legal right to opt out of this data collection and trade. But you can and also should and freeze your credit, which by the way can make your credit profile less profitable for companies like Equifax — because they make money every time some potential creditor wants a peek inside your financial life. Also, it’s probably a good idea to freeze the credit of your children and/or dependents as well. It’s free on both counts.

The Equifax Breach Settlement Offer is Real, For Now – Krebs on Security

@briankrebs Time to start monitoring spoofy domain names...

@briankrebs For example, the following all look like they don't have any connection to Equifax itself:

equifaxbreachsettlement,com
equifaxbriefsettlement,com
equifaxbreachsettlementbreach,com
equifaxsettlements,co
eportsupport-equifax,com
equifaxbreechsettlement,com
ecuifax,co.uk
equifaxfreecreditscore,com
indianaequifaxclaim,com

...and others

Shields up!

@ColonelPanic @briankrebs I think it's fair to say if it's not equifax.com or it's other country domain TLDs it's not legit.
@venivv @briankrebs That certainly seems to be the case here. Sometimes the legit company does a lot of defensive registrations of these kinds, but what I'm looking at does not appear to be that. Several of those domains have close ties to a lot of other sketchy domains (not specific to Equifax).

@ColonelPanic @briankrebs If anyone is reading this I wouldn't EVER trust anything from a company if it doesn't come from their TLD. Subdomains are fine, but if you get an email from "amazon" that isn't amazon.com or <subdomain>.amazon.com or what have you; it's not legitimate.

Spam is spam. Phishing is phishing. This is just a day to day internet safety rule.