Last September, Christian Haigh learned he was one of the 143 million people in the U.S. whose information was hacked in the Equifax breach.

As you might recall, Equifax issued an apology that was almost laughable. Lawyers started class-action lawsuits. But Haigh, who is a co-founder and CTO of litigation finance startup Legalist, had a different approach.

He filed suit against the credit reporting giant in small-claims court in San Francisco.

This was a brilliant idea. I imagine it's unlikely Equifax thought it would be dealing with individual plaintiffs, suing for fairly small dollar amounts, in very informal courtrooms across the country.

(I have to "imagine" this, to be clear, because I haven't heard back after emailing the three top U.S. media contacts listed on Equifax's website asking for any comment on this story.)

Ultimately, Haigh won an $8,000 judgment against the credit reporting giant--later reduced to $5,500 on appeal. In the process, his company started funding other people's small claims suits against Equifax, too. (Legalist pays lawyers in plaintiff's suits on an hourly basis, and takes a contingency fee if the case is successful.)

I interviewed Haigh and his co-founder, CEO Eva Shang, after reading two blog posts in which Haigh described his experience (here and here). The two co-founders, both in their early 20s, were friends at Harvard who left before graduating for Y Combinator, and who raised a $10 million investment round last summer.

"I think the theme our company really believes in is that the justice system should be reoriented to help the underdog," Shang said. "A lot of people... believe it's so stacked in favor of people who have money and power."

As I learned more about Haigh's case and the company, I kept seeing certain principles emerge--principles I think can help David beat Goliath in almost any situation. Here's the story.

Fortune favors the bold.

Here's the timeline: The breach happened in July; Equifax disclosed it on September 7. Haigh filed suit on September 19. That's rocket-speed in litigation. 

In fact, many lawyers seem to wait until the last day before the statute of limitations expires on a claim before filing. Not Haigh, and none of this would have worked out for him if he hadn't raced to the courthouse.

"Since we heard about [the Equifax breach] and realized I'd been impacted, I wanted to do something about it," Haigh told me. "And if I didn't do something then, I would have never done it. I would have waited until the class actions and forgotten. I wanted to do something."

Choose your battlefield.

If your data was breached, you may choose not to fight, but that only means that you've conceded easily. If you are going to fight, it's best if you can be the one to choose where the fight takes place.

Here, that meant small-claims court. Doing battle with Equifax there resulted in a "much more relaxed situation," Haigh said. As we'll see, it worked to his advantage. Contrast that to the many who simply logged into Equifax's website for a year of free credit monitoring--or else, did nothing at all.

Turn weaknesses into strengths.

This is when things start to get graceful; when you can find a way to turn something that should be working against you into an advantage. Haigh isn't a lawyer, and this was his first time in court. But as Shang pointed out:

"When you're showing up in small claims court, it's not a literal battle between you and the other side. It might feel like it, but you're really trying to impress the judge. It's an arena for regular people to settle grievances. So Christian's weakness--no law degree--became his strength."

Turn strengths into weaknesses.

Haigh won, but Equifax appealed the judgment, and it sent a high-powered lawyer from the law firm of King & Spalding to oppose him--along with an in-house lawyer and a company vice president. It would have been natural to be intimidated, but Haigh said he realized this could actually be a good thing for him.

"Equifax, being a large national corporation, part of their litigation strategy is to hire the best people, so they hire King & Spalding. But they're not really thinking through the fact that King & Spalding probably doesn't go to small-claims court very often," he told me.

Sure enough, Haigh writes in his blog post, this benefited him when the company's lead lawyer didn't know (or seemed not to know) that in small claims court, hearsay evidence is admissible. Thus, he wasted time and effort arguing that Haigh shouldn't be allowed to use a report about the Equifax breach from Senator Elizabeth Warren as evidence. 

Show up. 

As the great philosopher Wayne Gretzky once put it, you miss 100 percent of the shots you don't take. And I guess you lose 100 percent of the small-claims court cases you never get around to filing.

"This is a no-brainer," Haigh wrote in his blog post, "but I looked up the woman who came after me as well as the man who preceded me. They both got similar awards, in the $8,000 range. Just showing up to court could mean a significant judgment."

Keep showing up.

As long as I'm punctuating these principles with quotes, how about one supposedly from Winston Churchill: "Success consists of going from failure to failure without loss of enthusiasm."

The obvious example of this principle here is the extra effort that Haigh put into winning the appeal--along with his increased "confidence that no matter how stacked the odds are against you, the better case will prevail."

Eat your own dog food.

I honestly don't know if Haigh and Shang filed this suit expecting to fund other people's small-claims cases against Equifax, or if they came up with the idea only afterward. But Shang told me that not long after the data breach story broke, "we actually started getting applications" for funding these kinds of cases.

"It's not our main business--our main business is funding business claims, usually," she said. But she added that with Equifax, "we realized if they pursued their cases in small-claims court, it might be a good opportunity. So we put out an announcement that we would fund Equifax cases, and they really started coming in."