When Congress hauls in Equifax CEO Richard Smith to grill him, it can start by asking why he put someone with degrees in music in charge of the company’s data security. 
 
 And then they might also ask him if anyone at the company has been involved in efforts to cover up Susan Mauldin’s lack of educational qualifications since the data breach became public. 
 
 It would be fascinating to hear Smith try to explain both of those extraordinary items. 
 
 If those events don’t put the final nails in his professional coffin, accountability in the U.S. is officially dead. And late Friday Equifax said both Mauldin and the company’s chief information officer have retired effective immediately. 
 
 Susan Mauldin’s LinkedIn page was made private and her last name replaced with “M.” 
 
 Equifax “Chief Security Officer” Susan Mauldin has a bachelor’s degree and a master of fine arts degree in music composition from the University of Georgia. Her LinkedIn professional profile lists no education related to technology or security. 
 
 This is the person who was in charge of keeping your personal and financial data safe — and whose apparent failings have put 143 million of us at risk from identity theft and fraud. It was revealed this week that the massive data breach came due to a software vulnerability that was known about, and should have been patched, months earlier. 
 
 I emailed Equifax’s EFX, +0.49% multiple media relations people but have not heard back. 
 
 I was tipped off to this by a contact on Twitter. There has been very little coverage so far of Susan Mauldin’s background and training. Given the ongoing disaster of the hack and Equifax’s handling of the affair, the media spotlight has so far been elsewhere. 
 
 Reporting by a few tech-savvy blogs has found that as soon as the Equifax data breach became public, someone began to scrub the internet of information about Mauldin. 
 
 Video: Why victims of the Equifax breech should freeze their credit 
 
 Her LinkedIn page was made private and her last name replaced with “M.” Two videos of interviews with Mauldin have been removed from YouTube. A podcast of an interview has also been taken down. 
 
 Unhappily for the scrubbers, the internet archives some material and a transcript of one interview has survived. 
 
 To play devil’s advocate, Mauldin does at least have 14 years’ private-sector experience since getting her degrees. Music, to stretch the point as far as possible, is an academic subject that can be highly mathematical. 
 
 The question is how far any of this can take you in this field if you don’t have a formal education in technology. Mauldin’s counterparts at Equifax’s two biggest competitors, TransUnion TRU, +2.71% and Experian EXPN, +2.28% studied computers and science, respectively. 
 
 In an interview I found, Mauldin said that in recruiting, “[w]e’re looking for good analysts, whether it’s a data scientist, security analyst, network analyst, IT analyst, or even someone with an auditing degree. ... Security can be learned.” 
 
 But she also said she focuses college recruitment, understandably, on “universities that have programs in security, cyber security, or IT programs with security specialties.” She did not mention music composition. 
 
 Everything about this fiasco just gets more and more surreal. 
 
 Read next: Were you affected by Equifax’s breach? You risk financial chaos by doing nothing ||||| NEW YORK (AP) — Equifax announced late Friday that its chief information officer and chief security officer would leave the company immediately, following the enormous breach of 143 million Americans' personal information. 
 
 The credit data company — under intense pressure since it disclosed last week that hackers accessed the Social Security numbers, birthdates and other information — also released a detailed, if still muddled, timeline of how it discovered and handled the breach. 
 
 Equifax said that Susan Mauldin, who had been the top security officer, and David Webb, the chief technology officer, are retiring. Mauldin, a college music major, had come under media scrutiny for her qualifications in security. Equifax did not say in its statement what retirement packages the executives would receive. 
 
 Mauldin is being replaced by Russ Ayers, an information technology executive inside Equifax. Webb is being replaced by Mark Rohrwasser, who most recently was in charge of Equifax's international technology operations. 
 
 Equifax also provided its most detailed timeline of the breach yet, although it raised as many questions as it answered. 
 
 The tale began on July 29, when the company's security team detected suspicious network traffic associated with the software that ran its U.S. online-dispute portal. After blocking that traffic, the company saw additional "suspicious activity" and took the portal's software offline. 
 
 At this point, Equifax's retelling grows cloudy. The company said an internal review then "discovered" a flaw in an open-source software package called Apache Struts used in the dispute portal, which it then fixed with a software patch. It subsequently brought the portal back online. 
 
 But that vulnerability had been known publicly since early March 2017, and a fix was available shortly thereafter — facts that Equifax acknowledged in its Friday statement. The company did not say why the software used in the online-dispute portal hadn't been patched earlier, although it claimed that its security organization was "aware" of the software flaw in March, and that it "took efforts" to locate and fix "any vulnerable systems in the company's IT infrastructure." 
 
 It apparently missed at least one vulnerable system. The closest Equifax gets to explaining that? "While Equifax fully understands the intense focus on patching efforts, the company's review of the facts is still ongoing," according to its statement. 
 
 After patching the dispute-portal's software, Equifax hired Mandiant, a computer-security firm, to do a forensic review. That effort determined that hackers had access to Equifax systems from May 13 through July 30. 
 
 Equifax has been castigated for how it has handled the breach, which it did not disclose publicly for weeks after discovering it. 
 
 Consumers calling the number Equifax set up initially complained of jammed phone lines and uninformed representatives, and initial responses from the website gave inconsistent responses. The company says it has addressed many of those problems. Equifax also said Friday it would continue to allow people to place credit freezes on their reports without a fee through Nov. 21. Originally the company offered fee-free credit freezes for 30 days after the incident. 
 
 Equifax is also facing several inquiries and class-action lawsuits, including Congressional investigations, queries by the Federal Trade Commission and the Consumer Financial Protection Bureau, as well as several state attorneys general. The company's CEO Richard Smith is scheduled to testify in front of Congress in early October. 
 
 Three Equifax executives — not the ones who are departing — sold shares worth a combined $1.8 million just a few days after the company discovered the breach, according to documents filed with securities regulators. 
 
 Equifax shares have lost a third of their value since it announced the breach. 
 
 ___ 
 
 AP Technology Editor David Hamilton in San Francisco contributed to this report. ||||| CLOSE Names, Social Security numbers and addresses of millions of people were exposed during the Equifax breach. Video provided by Newsy Newslook 
 
 File photo taken in 2012 shows the Georgia headquarters of credit reporting and monitoring giant Equifax. (Photo: Mike Stewart, AP) 
 
 Credit-reporting giant Equifax was hit with a class-action lawsuit within hours after disclosing that a cyberattack had potentially compromised personal information for 143 million U.S. consumers. 
 
 Filed in Oregon federal court late Thursday, the civil action accuses the Georgia-based company of failing to maintain adequate electronic security safeguards as part of a corporate effort to save money. 
 
 The lawsuit on behalf of plaintiffs Mary McHill and Brook Reinhard seeks an order requiring Equifax to preserve all records related to the breach and formally designating the case as a class-action for all consumers affected by the cyberattack. 
 
 The court complaint also seeks "fair compensation" and costs to be decided by a federal jury. 
 
 "In an attempt to increase profits, Equifax negligently failed to maintain adequate technological safeguards to protect Ms. McHill and Mr. Reinhard's information from unauthorized access by hackers," Oregon attorney Michael Fuller wrote in the complaint. 
 
 "Equifax knew and should have known that failure to maintain adequate technological safeguards would eventually result in a massive data breach." 
 
 News of the cyberbreach immediately prompted Reinhard to pay $19.95 to pay for third-party credit monitoring services "he otherwise would not have had to pay for," the lawsuit charged. 
 
 Equifax did not immediately respond to a message seeking comment on the case. 
 
 The scope of the cyberbreach — potentially affecting nearly half of the nation's population — instantly vaulted made the attack into the ranks of the largest electronic data compromises in U.S. history. 
 
 "With so many people possibly at risk, this is among the most serious attacks ever," said Avivah Litan, a security analyst at technology research giant Gartner. "You should probably just assume your information has been breached." 
 
 The FBI said it was "aware of the reporting and tracking the situation as appropriate." New York Attorney General Eric Schneiderman issued a consumer alert and started a formal investigation in which his office requested more information from Equifax. 
 
 On Capitol Hill, Rep. Jeb Hensarling, R-Texas, who chairs the House Committee on Financial Services, said the panel would hold a hearing to examine the cyberattack. Sen. Tammy Baldwin, D-Wisc., urged leaders of the Senate Committee on Commerce, Science, & Transportation to do the same. 
 
 Equifax said the cyberattack was discovered on July 29 and was carried out from mid-May to July 2017. The breach primarily involved names, Social Security numbers, birth dates, addresses and, in some cases, driver's license numbers for U.S. consumers, said Equifax. 
 
 The suspected criminal hacker or hackers behind the attack also gained access to credit-card numbers for approximately 209,000 consumers, along with certain dispute records with personal identifying information for roughly 182,000 consumers, Equifax said. 
 
 Additionally, the company identified unauthorized access to limited personal information for certain residents of the United Kingdom and Canada. 
 
 CLOSE Nearly half of all Americans are affected by a cyber security breach at Equifax, one of the nation's three major credit-reporting agencies. Here's how to avoid being a victim. USA TODAY 
 
 However, Equifax said there was no immediate evidence of improper activity on the company's core consumer or commercial credit-reporting databases. 
 
 Some consumers complained about the nearly six-week lag between the discovery of the attack and Equifax's public disclosure. The company said it took immediate steps to halt the intrusion and hire an independent cybersecurity firm to evaluate the breach and its impact. 
 
 "Because this incident involves a substantial amount of personal identifying information, the investigation has been complex and time-consuming. As soon as we had enough information to begin notification, we took appropriate steps to do so," Equifax said. 
 
 The company dedicated and launched a new website, www.equifaxsecurity2017.com, to help consumers determine whether their personal information may have been accessed and sign up for one year of free credit file monitoring and identity theft protection. 
 
 Equifax, along with Experian and TransUnion, is one of the three-largest credit-reporting firms in the U.S. The company organizes and analyzes data on more than 820 million consumers and more than 91 million businesses worldwide. Equifax's databases hold employee data submitted by more than 7,100 employers. 
 
 However, some consumers complained about delays in getting access to the website and additional delays in formalizing their registrations. 
 
 My enrollment date is 9/12. WHY NOT RIGHT AWAY?! And why is it MY responsibility to go back on the site on that day?! #equifaxbreach — Dagmar Bleasdale (@DagmarBleasdale) September 8, 2017 
 
 The breach represents the third significant cybersecurity threat at Equifax in recent years. Hackers in 2016 stole federal W-2 tax information from an Equifax website. Identity thieves earlier this year also stole W-2 tax information from an Equifax subsidiary, TALX, which provides online payroll services. 
 
 Follow USA TODAY reporter Kevin McCoy on Twitter: @kmccoynyc 
 
 Read or Share this story: https://usat.ly/2vSWy34
– Two senior Equifax execs have stepped down as the investigation of what may be the biggest data breach in US history continues. The credit-reporting firm says security chief Susan Mauldin and chief technology officer David Webb are retiring effective immediately, the New York Times reports. After the leak that exposed the data of 143 million Americans became public, it emerged that Mauldin has a degree in music composition but apparently no education in technology or security. Interviews with Mauldin have been removed from YouTube, though MarketWatch unearthed a transcript of one in which she says they are interested in hiring good analysts of any kind, because "security can be learned." The departing execs are not among the three that sold off $1.8 million in shares days after the company discovered the breach. The company's shares have dropped by around a third since the breach was disclosed, the AP notes. Democratic senators introduced a bill Friday that would ban Equifax from profiting from the breach by charging for credit freezes. At Bloomberg, the editorial board argues that Equifax should be dealt with under existing legislation, which allows the Consumer Financial Protection Bureau to "penalize companies for failing to make 'reasonable' efforts to keep sensitive information out of the wrong hands." (For two months, Equifax failed to fix the known security hole that hackers exploited.)