Criticism of Equifax data breach response mounts; shares tumble

Equifax Inc faced a storm of criticism on Friday over a hack that may have compromised personal data for some 143mn Americans, with consumers clamouring for answers and cyber security experts questioning the response to the massive breach.Lawmakers and regulators joined the chorus, scrutinising the company’s follow-up as it encouraged potentially affected customers to sign up for free credit monitoring services.Equifax shares tumbled as much as 18%, the biggest one-day drop in 16 years.The hack, among the largest ever recorded, was especially alarming due to the richness of the information exposed, which included names, birthdays, addresses and Social Security and driver’s licence numbers, cyber researchers said.“Another day, another dumpster fire in cyber security,” said Ryan Kalember, senior vice president of cyber security firm Proofpoint.The breach was “especially troubling” because companies that have suffered data breaches typically offer free credit monitoring services from firms like Equifax, which has now itself suffered a huge cyber attack, he added.Bigger hacks, such as those disclosed by Yahoo last year, did not put as much sensitive information at risk.Moody’s Investors Service said on Friday that the breach would impede Equifax’s growth over the next three to four quarters and hurt its reputation as a custodian of consumer data.The company would incur significant costs to remediate the breach, potential litigation and regulatory action, and higher cyber insurance premiums, Moody’s said.But it said that Equifax’s rating and stable outlook were not affected.Credit monitoring services such as Equifax collect vast amounts of financial information from consumers without their knowledge, working with banks and other lenders, for example, to track the creditworthiness of individuals.At least five state attorneys general, including those of New York and Illinois, said they were formally investigating the breach.Two proposed class-action lawsuits, one filed in Portland, Oregon, and one in Atlanta, alleged that Equifax had been negligent in protecting consumer data.Atlanta-based Equifax disclosed the breach on Thursday and said the company had discovered it on July 29.It said hackers accessed accounts between mid-May and July, and some British and Canadian residents were also affected.The company has not said specifically how attackers were able to break in or why it did not disclose the breach sooner.The Federal Bureau of Investigation said it is tracking the matter.A US intelligence official told Reuters it was too soon to know if the attack was strictly criminal in nature or if it had the backing of a foreign government. Twitter users on Friday reported that Equifax customer service representatives were difficult to reach and either unhelpful or unaware that the breach had occurred.Equifax also drew scrutiny for terms of service that accompanied a free credit monitoring offering to all US consumers worried about the data breach that it promoted on its support website.Agreeing to the terms appeared to forfeit some rights to sue individually or join a class-action suit, but Equifax said on its website that the arbitration clause applied only to the credit monitoring offer and not to any damages caused by the recently discovered data breach.The US Consumer Financial Protection Bureau, however, still had concerns with the terms associated with the free credit monitoring offer.It is “troubling that Equifax is forcing people to waive legal rights in order to receive fraud monitoring after the company’s breach put their personal information at risk,” a CFPB spokesman said in a statement. Equifax did not respond on Friday when asked about criticism of its response or its terms of service.A Reuters reporter attempted to enrol late on Thursday in the service Equifax set up to let customers know if they had been affected and received a confirmation that said enrolment would begin next Tuesday.“Please be sure to mark your calendar as you will not receive additional reminders,” the confirmation said.It did not state whether the reporter had been impacted by the breach.But on Friday the site appeared to be working more effectively, with a few individuals reporting that they had been able to get answers on whether their personal information had been breached.In a statement, Cisco Systems Inc said its threat protection services initially blocked users from accessing Equifax’s support website because it was flagged for potentially malicious activity.The block was triggered because it was a new website that “had different characteristics from the company’s business site,” Cisco said, adding that the support site was no longer blocked.Some cyber security experts criticised Equifax for setting up a support website under a different domain than the company’s main website, mirroring a tactic that can be used to fraudulently collect data.The US House of Representatives Financial Services Committee and the House Energy and Commerce Committee both announced plans on Friday to hold hearings examining the breach, though no dates had been set.Representative Ted Lieu asked Equifax why it waited so long to disclose the breach and has asked the House Judiciary Committee to hold a hearing with the three major credit reporting agencies to explain how they will prevent future attacks.Within the past two years, Equifax has had W-2 federal wage tax data stolen from its website and a subsidiary.Larger rival Experian Plc reported a data breach two years ago involving some 15mn people. Senator Richard Blumenthal pointed to Equifax’s previous incidents and said it had “no excuse” for not strengthening cyber security, and called on the US Federal Trade Commission to investigate whether the company had done enough to secure its systems. Equifax shares closed down 13.7% at $123.23 after touching a more than seven-month low.Shares of rival TransUnion finished down 3.8%, while Experian closed down 0.7% on the London Stock Exchange.Three Equifax executives, including chief financial officer John Gamble, sold shares worth nearly $1.8mn three days after the breach was detected, according to regulatory filings.The company said in a statement the executives were not aware an intrusion had occurred when they sold their shares.Equifax handles data on more than 820mn consumers and 91mn businesses worldwide and manages employee information from more than 7,100 employers, according to its website.