The crux:

> Lewis issued a court order that found West was owed money to cover the cost of up to two years of payments to online identity protection services

So Equifax was liable for the insurance/protection that West bought out of fear for her financial safety. This is a fascinating solution to the problem that general plaintiff cannot sue until after they have provable harm. Instead of waiting for a rare $XXX loss and then suing for recovery, many plaintiffs can pay $X for insurance/protection and then sue for that cost.