There are still a couple of areas where Equifax is charging consumers, Connecticut Attorney General George Jepsen told CNBC on Monday.
The credit reporting agency revealed in early September it suffered a massive data breach that could potentially affect 143 million consumers. The company said the breach was discovered July 29.
"Consumers whose personal information has been compromised shouldn't be paying for the mitigation of that loss," Jepsen said in an interview with "Closing Bell."
While free credit monitoring is available to consumers, Equifax has not disabled its link to a fee-based credit monitoring service, he said.
"If you go to the wrong box, you don't get the free credit monitoring. You pay $17.95 a month."
Jepsen, along with 33 other state attorney generals, is asking Equifax to disable the fee-based link. His office is also part of the bipartisan states' investigation probing the breach.
Earlier on Monday, the District of Columbia's attorney general, Karl Racine, told CNBC Equifax has been responsive.
Jepsen also said Equifax should cover the cost of a credit freeze at other credit monitoring services. The firm has waived the fee for its site until Nov. 21.
"That's not right. It's just wrong that consumers protecting themselves due to Equifax's negligence should be on the hook for those kinds of fees that can mount up," he said.
However, he wouldn't comment on what fines might be sought against the company until it is known exactly what occurred.
"The first step is protecting consumers and doing everything possible to mitigate the risk for consumers to have their compromised information actually being used," he said.
An Equifax spokesperson told CNBC earlier in the day, "We cannot comment on pending litigation, but want to reassure consumers that we are remaining focused on helping them to navigate this situation and providing the best customer support possible."
— CNBC's Sarah O'Brien and Berkeley Lovelace contributed to this report.
WATCH: DOJ investigating Equifax in criminal probe
