The settlement with US federal authorities and states includes up to $US425 million in monetary relief to consumers, a $US100 million civil penalty, and other offers to the nearly 150 million people who could have been affected.

The breach was one of the largest ever to threaten Americans' private information.

The credit reporting company didn't notice the intruders targeting its databases, who exploited a known security vulnerability that Equifax hadn't fixed, for more than six weeks.

The compromised data included Social Security numbers, birth dates, addresses, driver license numbers, credit card numbers and in some cases, data from passports.

The resulting scandal led to the abrupt dismissal of Equifax's then-CEO and many other executives at the company.

"Companies that profit from personal information have an extra responsibility to protect and secure that data," said Federal Trade Commission Chairman Joe Simons.

"Equifax failed to take basic steps that may have prevented the breach."

Should all 147 million victims sign up for credit monitoring services, Equifax could potentially be on the hook for $US2 billion.

Equifax will offer victims of the breach free credit monitoring services for up to 10 years, identity-restoration services for seven years, and six Equifax credit reports annually for the next seven years.

That's on top of the free report all credit reporting companies must offer US residents every year.

Equifax will also have to spend at least $US1 billion over five years to enhance its cybersecurity practices and will owe a $US100 million fine to the Consumer Financial Protection Bureau and tens of millions of dollars to states and territories to settle their lawsuits.

Australian Associated Press