Equifax will pay $671 million to settle numerous state class-action lawsuits and investigations by the Federal Trade Commission, New York Department of Financial Services and Consumer Financial Protection Bureau, the company said Monday.

The deal, which is still subject to a six-month court approval process, will establish a consumer restitution fund of up to $425 million, which will pay for credit monitoring from all three bureaus and any "out-of-pocket losses related to the breach." As an alternative, consumers can request a $125 cash payment if they already have been signed up for credit monitoring services that will continue for at least six months.

Consumers may also be eligible for payments of up to $20,000 for time they spent remedying fraud or misuse of personal information or out-of-pocket losses.

But that will likely be an uphill battle. As CNBC previously reported and as , repeated several times on a conference call Monday, the data connected with the Equifax breach has never been found for sale on the dark web. Instead, intelligence experts and security executives have told CNBC that the information was likely stolen by a foreign intelligence agency for spying purposes.

This means proving your data was misused as a result of the breach would be a difficult fight.

Settlements for "out-of-pocket" costs related to a security breach are already extremely rare, and generally must involve proving a direct connection between a real financial loss directly connected to data stolen. The same principle could have applied to proving fraud or data misuse, which would require consumers to prove the fraud was related to having their data stolen as a result of the Equifax breach and not a breach of another company.

But a spokesperson for the New York Attorney General's Office said it will enforce a rule that will allow consumers who have been the victim of identity theft from any breach, not just Equifax, to apply for the out-of-pocket reward.