The American Consumer Credit Union has filed a class action lawsuit against Equifax, saying it “intentionally and intentionally” failed to notify consumers about the security breach that exposed their credit information.

The lawsuit alleges that Equifax failed to make “reasonable and timely” efforts to notify the credit bureau about the breach before September 1, 2015.

Equifax and Equifax Credit Protection, which is based in Atlanta, have denied the claims in the lawsuit.

Equifax said in a statement it is “deeply troubled by these allegations” and that the company will cooperate with law enforcement.

This story has been updated to clarify that Equipay, a subsidiary of Paypal, has also filed a lawsuit against the credit-reporting agency.