Equifax's Troubles Deepen Amid New Disclosure About Breach
Credit agency Equifax traced the theft of sensitive information about 143 million Americans to a software flaw that could have been fixed well before the burglary occurred, further undermining its credibility as the guardian of personal data that can easily be used for identity theft.
Ken Sweet & Michael Liedtke, AP Business Writers
NEW YORK (AP) — Credit agency Equifax traced the theft of sensitive information about 143 million Americans to a software flaw that could have been fixed well before the burglary occurred, further undermining its credibility as the guardian of personal data that can easily be used for identity theft.
Equifax identified a weakness in an open-source software package called Apache Struts as the technological crack that allowed hackers to heist Social Security numbers, birthdates, addresses and full legal names from a massive database maintained primarily for lenders.
SECURITY FOR DUMMIES
The disclosure , made late Wednesday, cast the company's damaging security lapse in an even harsher light. The software problem was detected in March and a recommended software patch was released shortly afterward. Equifax said the database intrusion began in May and continued until July.
Security experts said Equifax had more than enough opportunity to block intruders by sealing the security hole. "There is no excuse for not following basic cybersecurity hygiene," said Nate Fick, CEO of the security firm Endgame. "Some heads should definitely roll for this; it's only a question of how many."
The company didn't respond to inquiries on Thursday.
Equifax was already under fire for not disclosing the break-in until Sept. 7 — nearly six weeks after the company discovered it — as well as for its handling of consumer inquiries about their exposure whether their personal information had been compromised and how they could protect their identities.
THE ENRON COMPARISON
On Thursday, Sen. Charles Schumer, D-New York, called for the resignations of CEO Richard Smith and Equifax's entire board of directors unless the company offers consumers more comprehensive identity-theft protection for the next decade. So far, Equifax is merely offering free credit monitoring for a year. It's also temporarily waiving fees for people who freeze their credit records to prevent identity thieves from defrauding them.
"What has transpired over the past several months is one of the most egregious examples of corporate malfeasance since Enron," Schumer said, invoking the name of a notorious company that manipulated energy markets and eventually went bankrupt.
Investors are clearly concerned about Equifax's fate. The company's stock has lost nearly a third of its value since it disclosed the breach. Three Equifax executives, including the company's chief financial officer, preserved a significant chunk of their wealth by selling stock worth a combined $1.8 million just after management learned of the breach, but well before the public was notified.
Equifax said last week that the officials didn't know about the breach at the time of those sales.
MORE INVESTIGATION
In another sign of the storm swirling around Equifax, the Federal Trade Commission took the unusual step of announcing it has opened a probe into the company's practices.
The FTC is not the only Washington authority looking into the breach. The Consumer Financial Protection Bureau previously announced its own investigation, and the House Financial Services Committee plans to hold hearings on the breach in early October when Smith is scheduled to testify. Politicians from both major parties are calling for additional investigations by Congress or the Department of Justice, raising the possibility of criminal charges.
A proposal to impose sweeping reforms on Equifax and its two main peers, TransUnion and Experian, also has been drawn up by Rep. Maxine Waters, D-California.
Liedtke reported from San Francisco.
Latest in Security
Ransomware Attack Shuts Hundreds of KFC, Taco Bell Locations
ShotSpotter Document Reveals Key Human Role in Gunshot Tech
T-Mobile Says Data on 37 Million Customers Stolen
U.S. Charges Suspect Linked to Notorious Ransomware Gang
Biden Warns U.S. Companies to Beware Russian Cyber Attacks
Google Buys Cyber Security Firm Mandiant for $5.4B
More in Security
Yum Brands said attackers took company data, but there is no evidence customer data was stolen.
Human employees can quickly overrule and reverse the algorithm's determinations.
The company has been hacked multiple times in recent years.
How to Shelter from a Nuclear Explosion
The team used advanced computer modeling to study how a nuclear blast wave speeds through a standing structure.
U.S. Official Warns of Risks Posed by Heavy Electric Vehicles
The extra weight that EVs typically carry stems from the outsize mass of their batteries.
Security Breach: The Benefits of Being a Target
Why battling alert fatigue, understanding dormant footholds and developing a risk tolerance are key to cyber defense in 2023.
Former GE Engineer Gets 2 Years for 'Textbook' Economic Espionage
He tried to steal trade secrets surrounding the company's ground-based and aviation-based turbine technologies.
Facial Recognition Tool Led to Mistaken Arrest, Lawyer Says
Critics say the technology results in a higher rate of misidentification of people of color.
VW Recalls Beetles to Replace Takata Air Bags
The company is recalling nearly 42,000 vehicles.
California Earthquake Puts Early Warning System to the Test
An alert is triggered when sensors pick up the first signs of a strong earthquake.