Banking/Credit
Regulators in 8 states order Equifax to improve its cybersecurity
Published: June 27, 2018 at 5:12 p.m. ET
Lalita Clozel
Continued fallout from disastrous 2017 data breach
The corporate offices of credit reporting company Equifax Inc. in Atlanta.
WASHINGTON — Equifax Inc. must improve how it manages cybersecurity risk, regulators from eight states said Wednesday, responding to a 2017 data breach that exposed the personal data of nearly 148 million consumers.
The consent order, issued by regulators in Texas, California, New York and five other states, is the first major regulatory punishment for Equifax EFX, -0.35% , which agreed to the order but neither admitted nor denied wrongdoing.
"The breach never should have happened," Jan Owen, the commissioner of the California Department of Business Oversight, said in a statement. "This order will help ensure it doesn't happen again."
Under the terms of the order, the credit-reporting firm will have 90 days to strengthen its information-security defenses, including in vendor-risk management, patches and disaster response.
An expanded version of this report appears on WSJ.com.
How everything around you could soon turn into a subscription
Also popular on WSJ.com:
North Korea is rapidly upgrading nuclear site despite summit vow.
The SEC has had its own questions about LaCroix.
A Raymond James analyst thinks this year will be a "watershed moment" for the hydrogen economy.