Dealing with Bad (Equi)Fax - What Can Your Company Do Differently?

September 25, 2017

Equifax, one of the nation's largest credit reporting agencies, announced in early September that it suffered a massive data security breach from May through July 2017, potentially exposing Social Security numbers and other personal information of approximately 134 million customers. The initial announcement was shocking. Arguably worse for Equifax, however, has been its apparent mishandling of the information it releases to the public post-breach.

Equifax's initial announcement did not explain why Equifax waited over two months - into early September -- to announce the May-July breach. There are several plausible explanations. With a breach of this magnitude, thoroughly investigating the source of the breach and the number of customers affected could take months.

Moreover, no uniform statute or regulation governs a nationwide data security breach. Companies such as Equifax must adhere to the laws of all 50 states, which vary on everything from what actually constitutes a breach to when and how to report a breach to law enforcement and other governmental agencies, to how to conduct the investigation.

Equifax likely expended a considerable amount of time and money consulting with advisors on compliance with state laws. Equifax should have explained that when it announced the breach. Its silence instead led many to question Equifax's motives.

Worse, just days after Equifax announced the breach, media outlets reported that Equifax's chief financial officer and two other senior executives sold approximately $2 million of Equifax stock between Equifax's discovery and public announcement of the breach. The U.S. Department of Justice has opened an investigation into potential insider trading. Equifax's spokesperson claims the executives were unaware of the breach when they sold their stock.

Completing the bad-news trifecta, on September 20, 2017, media outlets reported that for at least two weeks, Equifax's official Twitter account inadvertently directed users to a look- alike phishing website set up to spoof Equifax's legitimate customer information site. The fake website, which uses an address that is nearly identical to Equifax's legitimate website, asks customers to enter their information to register for free credit monitoring. When the media reported the error, Equifax's Twitter account deleted only one of several tweets that directed customers to the phishing site.

While it is too early to determine the impact and consequences of the Equifax breach, there are immediate lessons to learn. The most important is to hire competent consultants to assist in the investigation of the breach and experienced crisis- managers to manage the timing and content of the company's public statements about it.

Related Practices
Speaking Engagement July 19, 2024
Howard E. Nelson participates on the panel Hot Topics/Emerging Issues In Waste Management at the 38th Annual Environmental Permitting Summer School. The panelists discuss the latest policy changes including new emerging elements for site closures involving Water Management Districts, the effects of ...
Speaking Engagement July 18, 2024
Thomas F. Mullin participates on the panel Keeping Your Eye On The Ball: Scoping The Appropriate Environmental Due Diligence For The Project at the 38th Annual Environmental Permitting Summer School. The panelists discuss appropriate scoping of the environmental due diligence process, taking into co...
Speaking Engagement July 17, 2024
Howard E. Nelson participates on the panel Land and Golf Course Redevelopment: Opportunities and Challenges at the 38th Annual Environmental Permitting Summer School. The panelists discuss how to navigate the substantial challenges regarding land use, availability of water (quantity and quality), an...