The U.S. District Court for the Northern District of Georgia approved the settlement of a lawsuit filed against Equifax Inc. over the September 2017 data breach, Bloomberg Law reported.

The company will initially pay $380.5 million toward a fund from which settlement class members may claim out-of-pocket losses up to $20,000. Equifax will pay an additional $125 million if needed to cover those claims.

The company must also spend at least $1 billion on enhancing data security, and may be required to spend up to $2 billion more depending on the quantity of credit monitoring claims made.

Class counsel will receive a percentage-based fee of $77.5 million, reimbursement of $1.4 million in litigation expenses and service awards of $2,500 for each settlement class representative totaling no more than $250,000 in the aggregate.

In 2017, hackers accessed Equifax's systems through a software flaw and malfunctioning scanning tool, exposing consumer names, Social Security numbers and other sensitive personal information of about 150 million people.