Equifax - these people are not fit and proper to do the kind of business they do.
Appropriate punitive damages would be to enjoin Equifax by prohibiting them from using the Internet in the course of any part of the business they conduct. Just allowed to operate the same way they operated before the mid 1980s, i.e. no use of any internets. Upon penalty of jail time for the executives if they breach that order.