The Equifax breach isn’t the largest data breach, but it is one of the most troubling because of its massive scope, the nature of the information stolen, and the absolutely awful way in which it was handled.
While Hurricane Irma dominated the national news late last week, a man-made disaster unfolded in the background as credit reporting giant
Equifax disclosed that hackers had breached its website and accessed the personal identifying information (PII) of 143 millio
Americans, including Social Security Numbers, dates of birth, address and employment information and, in some cases, credit card numbers.
In terms of the number of people impacted, the Equifax breach is not the largest in history; that dubious distinction is held by Yahoo. However, it may end up being the most destructive due to the particularly sensitive nature of the compromised information and the fact that it impacted about half the U.S. population. Once minor children and other people who do not have credit histories are excluded, the picture becomes even bleaker. The Equifax breach may have compromised the PII of anyone living in the U.S. who has ever had a credit card, a car loan, a mortgage, a lease, or anything else that involves a FICO score.
Meanwhile, a group of hackers who claim to be behind the Equifax breach have demanded a
Bitcoin ransom of approximately $2.6 million in exchange for not publicizing the data.
How has Equifax responded to all of this? By doing … well, pretty much everything a company shouldn’t do after a data breach, especially one of this magnitude.
Equifax Breach Response: A Case Study in What Not to Do
As bad as this hack was, Equifax’s response to it has been even worse. Their actions have been so galling that members of Congress are
demanding hearings to investigate the breach and Equifax’s poor handling of it. Here are some of the highlights:
• Equifax first discovered the breach on July 29, after the hackers had been in their system for about a month.
• In the days following the discovery,
three senior Equifax executives sold approximately $1.8 million in shares. The company claims that said executives were not aware of the breach.
• The victims had to wait until early September to find out about it. Not only did Equifax wait several weeks to disclose the breach, but they also made their announcement while the nation was transfixed by Hurricane Irma, which was barreling towards Florida and prompting one of the largest mass evacuations in history.
• The
website that Equifax set up for victims to determine if they were part of the breach was so poorly constructed – complete with gaping security holes – that many visitors thought it was a phishing attempt.
• This same website appears to double as a marketing vehicle for Equifax’s own credit monitoring service. The company is offering a free year’s subscription to the victims, which begs an obvious question: If Equifax itself couldn’t keep victims’ data secure, why in the world would they trust the company’s “credit monitoring” service?
• Rather than taking responsibility for the hack, Equifax is seeking to
pass the buck, blaming a vulnerability in open-source server framework Apache Struts, even though there is currently no evidence that Struts was the source of the breach.
How bad do things have to get before we take cyber security seriously?
Another reason why the Equifax hack is so much worse than the hacks at Target, Yahoo, Verizon, Anthem, and other private-sector companies is that while consumers can choose to stop patronizing those other companies, they have no choice but to have their data handed over to Equifax. There is currently no way for consumers to “opt out” of having their personal and credit data aggregated by Equifax and its competitors, Experian and Trans Union. Even if there were, the modern economy runs on credit; without a FICO score, Americans cannot obtain car, home, or student loans, be approved for rental leases or, in some cases, find a job.
Equifax’s response to this hack has been inexcusable. So is the fact that the breach happened in the first place. If any company needed to practice proactive cyber security rooted in sound governance, risk, and compliance, it was Equifax. Equifax does not collect PII as a consequence of doing business; collecting PII is its business. As the old saying goes, with great power comes great responsibility, and Equifax has failed miserably in its responsibility not only to American consumers but also the entire nation.
The Equifax breach is going to end up affecting all Americans in one way or another. Will this be the breach that finally wakes businesses and individuals up and prompts them to realize that cyber security is now everyone’s responsibility? Let’s hope so, because we absolutely do not want to see a cyber attack that’s even worse than this one.