Dealing with Bad (Equi)Fax - What Can Your Company Do Differently?

September 25, 2017

Equifax, one of the nation's largest credit reporting agencies, announced in early September that it suffered a massive data security breach from May through July 2017, potentially exposing Social Security numbers and other personal information of approximately 134 million customers. The initial announcement was shocking. Arguably worse for Equifax, however, has been its apparent mishandling of the information it releases to the public post-breach.

Equifax's initial announcement did not explain why Equifax waited over two months - into early September -- to announce the May-July breach. There are several plausible explanations. With a breach of this magnitude, thoroughly investigating the source of the breach and the number of customers affected could take months.

Moreover, no uniform statute or regulation governs a nationwide data security breach. Companies such as Equifax must adhere to the laws of all 50 states, which vary on everything from what actually constitutes a breach to when and how to report a breach to law enforcement and other governmental agencies, to how to conduct the investigation.

Equifax likely expended a considerable amount of time and money consulting with advisors on compliance with state laws. Equifax should have explained that when it announced the breach. Its silence instead led many to question Equifax's motives.

Worse, just days after Equifax announced the breach, media outlets reported that Equifax's chief financial officer and two other senior executives sold approximately $2 million of Equifax stock between Equifax's discovery and public announcement of the breach. The U.S. Department of Justice has opened an investigation into potential insider trading. Equifax's spokesperson claims the executives were unaware of the breach when they sold their stock.

Completing the bad-news trifecta, on September 20, 2017, media outlets reported that for at least two weeks, Equifax's official Twitter account inadvertently directed users to a look- alike phishing website set up to spoof Equifax's legitimate customer information site. The fake website, which uses an address that is nearly identical to Equifax's legitimate website, asks customers to enter their information to register for free credit monitoring. When the media reported the error, Equifax's Twitter account deleted only one of several tweets that directed customers to the phishing site.

While it is too early to determine the impact and consequences of the Equifax breach, there are immediate lessons to learn. The most important is to hire competent consultants to assist in the investigation of the breach and experienced crisis- managers to manage the timing and content of the company's public statements about it.

Related Practices
Blog July 1, 2022
A recent letter addressed to the U.S. Treasury Secretary and a number of financial regulatory agencies by the American Bankers Association and bank trade associations demonstrates the growing intensity over the debate on the extent to which Environmental, Social and Governance (ESG) disclosures by c...
Blog June 30, 2022
It was recently announced that billionaire Ken Griffin is moving his $50 billion, 1,000-person hedge fund and trading firm – Citadel Securities – from Chicago to Downtown Miami. As momentous as this move is, it is in fact part of a well-established trend of financial firms relocating to ...
Blog July 1, 2022
Last year, the Miami City Commission approved a major zoning overhaul for the portion of Wynwood lying north of NW 29th Street — dubbed Wynwood Norte. The new regulations- Wynwood Norte NRD-2- include a robust Public Benefits Program that permits bonus Building Height in exchange for contribut...