Dealing with Bad (Equi)Fax - What Can Your Company Do Differently?

September 25, 2017

Equifax, one of the nation's largest credit reporting agencies, announced in early September that it suffered a massive data security breach from May through July 2017, potentially exposing Social Security numbers and other personal information of approximately 134 million customers. The initial announcement was shocking. Arguably worse for Equifax, however, has been its apparent mishandling of the information it releases to the public post-breach.

Equifax's initial announcement did not explain why Equifax waited over two months - into early September -- to announce the May-July breach. There are several plausible explanations. With a breach of this magnitude, thoroughly investigating the source of the breach and the number of customers affected could take months.

Moreover, no uniform statute or regulation governs a nationwide data security breach. Companies such as Equifax must adhere to the laws of all 50 states, which vary on everything from what actually constitutes a breach to when and how to report a breach to law enforcement and other governmental agencies, to how to conduct the investigation.

Equifax likely expended a considerable amount of time and money consulting with advisors on compliance with state laws. Equifax should have explained that when it announced the breach. Its silence instead led many to question Equifax's motives.

Worse, just days after Equifax announced the breach, media outlets reported that Equifax's chief financial officer and two other senior executives sold approximately $2 million of Equifax stock between Equifax's discovery and public announcement of the breach. The U.S. Department of Justice has opened an investigation into potential insider trading. Equifax's spokesperson claims the executives were unaware of the breach when they sold their stock.

Completing the bad-news trifecta, on September 20, 2017, media outlets reported that for at least two weeks, Equifax's official Twitter account inadvertently directed users to a look- alike phishing website set up to spoof Equifax's legitimate customer information site. The fake website, which uses an address that is nearly identical to Equifax's legitimate website, asks customers to enter their information to register for free credit monitoring. When the media reported the error, Equifax's Twitter account deleted only one of several tweets that directed customers to the phishing site.

While it is too early to determine the impact and consequences of the Equifax breach, there are immediate lessons to learn. The most important is to hire competent consultants to assist in the investigation of the breach and experienced crisis- managers to manage the timing and content of the company's public statements about it.

Related Practices
Client Alert February 2, 2023
On December 15, 2022, the Environmental Protection Agency published a final rule recognizing ASTM E1527-21 as the new standard for performing a Phase I Environmental Site Assessment (“ESA”). With this final rule, the “-21 standard” will become the governing standard to satisf...
Press Release January 27, 2023
In collaboration with the University of Miami (UM), Bilzin Sumberg is pleased to announce the commencement of “Bilzin Sumberg University”. The inaugural 12-month leadership development program addresses competencies for Bilzin Sumberg partners to be successful today and in the future.
Press Release January 26, 2023
Bilzin Sumberg is proud to announce it has been awarded the 2023 Chief Justice’s Law Firm Commendation Pro Bono Service Award in recognition of the firm’s outstanding efforts in support of pro bono services in the state of Florida.