Equifax, one of the three major consumer credit reporting agencies, said on Thursday that hackers had gained access to company data that potentially compromised sensitive information for 143 million American consumers, including Social Security numbers and driver’s license numbers.

The attack on the company represents one of the largest risks to personally sensitive information in recent years, and is the third major cybersecurity threat for the agency since 2015.

Equifax, based in Atlanta, is a particularly tempting target for hackers. If identity thieves wanted to hit one place to grab all the data needed to do the most damage, they would go straight to one of the three major credit reporting agencies.

“This is about as bad as it gets,” said Pamela Dixon, executive director of the World Privacy Forum, a nonprofit research group. “If you have a credit report, chances are you may be in this breach. The chances are much better than 50 percent.”</s>The credit reporting agency Equifax said Thursday that hackers gained access to sensitive personal data — Social Security numbers, birth dates and home addresses — for up to 143 million Americans, a major cybersecurity breach at a firm that serves as one of the three major clearinghouses for Americans' credit histories.

Equifax said the breach began in May and continued until it was discovered in late July. It said hackers exploited a "website application vulnerability" and obtained personal data about British and Canadian consumers as well as Americans. Social Security numbers and birth dates are particularly sensitive data, giving those who possess them the ingredients for identity fraud and other crimes.

Equifax also lost control of an unspecified number of driver's licenses, along with the credit card numbers for 209,000 consumers and credit dispute documents for 182,000 others. The company said it did not detect intrusions into its "core consumer or commercial credit reporting databases."

[Equifax asks consumers for personal info, even after massive data breach]

Equifax is one of the largest U.S.-based credit reporting agencies that collect and analyze detailed records of financial data for a wide range of consumers worldwide. The judgments of these companies about the creditworthiness of individuals can affect their ability to gain loans, housing and jobs, while also determining the interest rates on consumer products.

The information exposed in the Equifax breach is categorized as "personally identifiable information" or PII, and is regarded as particularly sensitive, experts say.

"The type of information that has been exposed is really sensitive," said Beth Givens, executive director of the Privacy Rights Clearinghouse, a consumer advocacy group based in San Diego. "All in all, this has the potential to be a very harmful breach to those who are affected by it."

The company did not respond to a question about why it waited six weeks to disclose the hack.

Bloomberg News reported Thursday evening that three company executives — Chief Financial Officer John W. Gamble; Joseph M. Loughran III, the president of U.S. information solutions; and Rodolfo O. Ploder, the president of workforce solutions — sold large amounts of their shares of Equifax stock totaling nearly $1.8 million in the days after the breach was discovered July 29. The Washington Post confirmed the sales based on Securities and Exchange Commission filings.

The stock trades were not part of a previous scheduled sale, federal filings show.

A company spokeswoman, Ines Gutzmer, said in an email Thursday night: "The three executives who sold a small percentage of their Equifax shares on Tuesday, August 1, and Wednesday, August 2, had no knowledge that an intrusion had occurred at the time they sold their shares."

On Thursday, after the company disclosed the hack, Equifax shares plummeted 12 percent in after-hours trading.

One of the other leading credit rating agencies, Experian, was hacked in 2015, causing the personal data of 15 million Americans to be exposed.

The recent hack of Equifax was far larger but fell short of data breaches suffered by Yahoo, which affected 1 billion people worldwide.

Equifax said Thursday that it was alerting those who were affected by mail. It also set up a website, equifaxsecurity2017.com, to help consumers understand the breach and check whether they were affected. The company is offering one year of free credit monitoring and identity theft protection to anyone who may have been affected.

[Why it can take so long for companies to reveal their data breaches]

"This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do. I apologize to consumers and our business customers for the concern and frustration this causes," Richard F. Smith, the company's chief executive, said in a statement published on its website. "We pride ourselves on being a leader in managing and protecting data, and we are conducting a thorough review of our overall security operations."

Equifax, based in Atlanta, is working with law enforcement on an investigation of the breach and has hired an independent cybersecurity research firm to assess the scope of the intrusion. The company's website says it operates in 24 countries and has access to the data of more than 820 million consumers worldwide, along with data for 91 million businesses.

Companies often do not immediately alert affected people to cybersecurity incidents, prompting periodic calls from state and federal legislators for new laws to require more rapid and complete disclosures to affected consumers.

On Thursday night, Sen. Mark R. Warner (D-Va.), co-founder of the Senate Cybersecurity Caucus, described the Equifax breach as "profoundly troubling" and called for more consumer protections against data theft and timely notification to consumers whose personal information is compromised.

"It is no exaggeration to suggest that a breach such as this — exposing highly sensitive personal and financial information central for identity management and access to credit — represents a real threat to the economic security of Americans," Warner said in his statement.

Although Equifax is widely known as a credit reporting agency, the company is also involved in the collection and sale of consumer data — a lucrative and loosely regulated industry that in 2013 attracted the scrutiny of Senate investigators.

In one report, the Senate Commerce Committee found that such data brokers were responsible for slicing up consumer data and categorizing Americans according to their financial characteristics, using labels such as "X-tra Needy," "Fragile Families" and "Ethnic Second-City Strugglers" to describe the financially vulnerable.

Critics say the practice allows for the targeting and marketing of predatory financial instruments, and that the labels reflect a fundamental callousness about the industry.

The Federal Trade Commission accused Equifax in 2012 of inappropriately selling thousands of lists of consumers' data to third parties, who then "used the lists to pitch loan modification and debt relief services to people in financial distress," according to the FTC.

Drew Harwell and Steven Mufson contributed to this report.</s></s>Hackers may have the names and social security numbers of 143 million Americans after a massive breach of credit-reporting agency Equifax, the company said Thursday.</s>Equifax says it suffered a massive data breach involving as many as 143 million people in the U.S. Social Security numbers, birth dates, addresses and drivers licenses were apparently exposed, thus making this one of the worst hacks ever reported.</s>(CNN) – Equifax, the credit reporting behemoth, said on Thursday that a massive security breach may have compromised the personal information of 143 million people.

Cyber criminals have accessed sensitive information — including names, social security numbers, birth dates, addresses, and the numbers of some driver’s licenses.

Additionally, Equifax said that credit card numbers for about 209,000 people were exposed, as was “personal identifying information” on roughly 182,000 customers involved in credit report disputes.

The breach occurred between mid-May and July, Equifax said. The company said it discovered the hack on July 29.

Equifax is mailing notices to people whose credit cards or dispute documents were affected.

“This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do,” said Equifax chairman and CEO Richard F. Smith.

Equifax is one of three nationwide credit-reporting companies that track and rates the financial history of U.S. consumers. The companies are supplied with data about loans, loan payments and credit cards, as well as information on everything from child support payments to credit limits, which all factor into credit scores.</s>Hackers gained access to up to 143 million Equifax customers’ data, including some credit card and Social Security numbers, the credit-reporting service announced Thursday.

In most cases, the hackers accessed names, Social Security numbers, birth dates, addresses and some driver’s license numbers, Equifax explained.

Additionally, 209,000 credit card numbers and other documents with personal information for 182,000 customers were accessed in the breach.

“Criminals” used a U.S. website application to gain access to the files from mid-May to June 2017, the company said in a statement.

The company said it discovered the intrusion on July 29 and worked immediately to stop it. An investigation should be finished within weeks.

"This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do. I apologize to consumers and our business customers for the concern and frustration this causes," Chairman and Chief Executive Officer Richard F. Smith said.

Equifax has set up a website for customers to see if their data has been compromised and access complimentary credit monitoring and identity theft services for a year.

Questions to the company can be directed here or to 866-447-7559

Customers will receive a notice in the mail if they were affected.</s>Nearly half of the US population may be impacted after a cybersecurity breach at credit reporting agency Equifax.

The company said information obtained in the breach includes the names, social security numbers, birth dates, addresses and some driver's license numbers of potentially 143 million Americans.

Equifax said it discovered the breach back on July 29 and unauthorized access started mid-May.

In addition to that breach, credit card numbers for about 209,000 consumers "and certain dispute documents, which included personal identifying information, for approximately 182,000 consumers" were accessed during the incident.

The company released the extent of the damage in a statement:

Certain UK and Canadian residents may be affected as well, according to Equifax.

According to Equifax, investigators have found no evidence of "unauthorized activity on Equifax’s core consumer or commercial credit reporting databases."

Equifax said the company is offering free identity theft protection and credit file monitoring to all U.S. consumers.

Check here if you are one of the 143 million people possibly affected.

Get more information about the incident from Equifax here.</s>SAN FRANCISCO — Credit monitoring company Equifax has been hit by a high-tech heist that exposed the Social Security numbers and other sensitive information about 143 million Americans. Now the unwitting victims have to worry about the threat of having their identities stolen.

The Atlanta-based company, one of three major U.S. credit bureaus, said Thursday that “criminals” exploited a U.S. website application to access files between mid-May and July of this year.

The theft obtained consumers’ names, Social Security numbers, birth dates, addresses and, in some cases, driver’s license numbers. The purloined data can be enough for crooks to hijack the identities of people whose credentials were stolen through no fault of their own, potentially wreaking havoc on their lives.

“On a scale of one to 10, this is a 10 in terms of potential identity theft,” said Gartner security analyst Avivah Litan. “Credit bureaus keep so much data about us that affects almost everything we do.”

Lenders rely on the information collected by the credit bureaus to help them decide whether to approve financing for homes, cars and credit cards. Credit checks are even sometimes done by employers when deciding whom to hire for a job.

Equifax discovered the hack July 29, but waited until Thursday to warn consumers. The Atlanta-based company declined to comment on that delay or anything else beyond its published statement. It’s not unusual for U.S. authorities to ask a company hit in a major hack to delay public notice so that investigators can pursue the perpetrators.

The company established a website, https://www.equifaxsecurity2017.com/ , where people can check to see if their personal information may have been stolen. Consumers can also call 866-447-7559 for more information. Experian is also offering free credit monitoring to all U.S. consumers for a year.

“This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do,” Equifax CEO Richard Smith said in a statement. “I apologize to consumers and our business customers for the concern and frustration this causes.”

This isn’t the biggest data breach in history. That indignity still belongs to Yahoo, which was targeted in at least two separate digital burglaries that affected more than 1 billion of its users’ accounts throughout the world.

But no Social Security numbers or drivers’ license were taken in the Yahoo break-in.

Equifax’s security lapse could be the largest involving the theft of Social Security numbers, one of the most common methods used to confirm a person’s identity in the U.S. It eclipses a 2015 hack at health insurer Anthem Inc. that involved the Social Security numbers of about 80 million people .

Any data breach threatens to tarnish a company’s reputation, but it is especially mortifying for Equifax, whose entire business revolves around providing a clear financial profile of consumers that lenders and other businesses can trust.

“This really undermines their credibility,” Litan said. It also could undermine the integrity of the information stockpiled by two other major credit bureaus, Experian and TransUnion, since they hold virtually all the data that Equifax does, Litan said.

Equifax’s stock dropped 13 per cent to $124.10 in extended trading after its announcement of the breach.

The potential aftershocks of the Equifax breach should make it clear that Social Security numbers are becoming an unreliable way to verify a person’s identity, Nathaniel Gleicher, the former director of cybersecurity policy in the White House during the Obama administration, said in an email statement.

“This breach might just have put the nail in the coffin of the idea that we can use personal identifiers like Social Security numbers as security factors,” wrote Gleicher, who now oversees cybersecurity strategy for computer security firm Illumio.

Besides all the personal information that was stolen in its breach, Equifax said the credit card numbers for about 209,000 U.S. consumers were also taken, as were “certain dispute documents” containing personal information for approximately 182,000 U.S. individuals.

The company said hackers also accessed some “limited personal information” from British and Canadian residents. Equifax said it doesn’t believe that consumers from other countries were affected.</s>Personal details of 143 million people in the US were potentially leaked during “a cybersecrutiy incident”, NYSE-listed credit reporting agency Equifax revealed today.

The company has blamed a “US website application vulnerability” for the breach.

“The information accessed primarily includes names, Social Security numbers, birth dates, addresses and, in some instances, driver's license numbers,” the company said in a statement.

“In addition, credit card numbers for approximately 209,000 U.S. consumers, and certain dispute documents with personal identifying information for approximately 182,000 U.S. consumers, were accessed.”

The company said that information of some UK and Canadian residents was also accessed during the breach, which it discovered on 29 July. The hackers had access to Equifax data from “mid-May” until the company discovered the breach.

The company said it has not discovered any evidence of unauthorised activity on its core consumer and commercial credit reporting databases.

An independent cyber security firm has been conducting a forensic review of the intrusion to determine its scope. Equifax expects the review to be completed “in the coming weeks”. The hack has also been reported to law enforcement agencies.

“This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do,” Equifax chairperson and CEO Richard F. Smith said in a statement.

“I apologise to consumers and our business customers for the concern and frustration this causes.”

“We pride ourselves on being a leader in managing and protecting data, and we are conducting a thorough review of our overall security operations,” the CEO said.

The company has established a website — https://www.equifaxsecurity2017.com/ — for people potentially affected by the incident.

Smith said that Equifax would offer a “comprehensive portfolio of services to support all US consumers, regardless of whether they were impacted by this incident”.
More than 143 million people in the U.S. may have had their social security and driver's license numbers compromised due to a data breach on the credit rating firm Equifax.