The theft of 143 million consumers' financial and identification data from Equifax is extremely serious. Victims face an entire lifetime of combating potential fraud and theft. Equifax makes more than $3 billion per year on consumers’ backs, but the breach was reportedly caused by Equifax’ negligence in properly fixing a known problem.
And it’s not just a matter of fraudulent accounts being opened. Even victims’ tax refunds, social security benefits, employment histories and prescription drugs may be at risk - for life.
What’s worse, Equifax didn’t tell anyone about the breach for some six weeks. Who should have been told?
- Consumers who didn’t consent to having their information stored and sold in the first place and may still not understand that Equifax had their information. (Formal notification had still not been made to individual consumers as of writing.)
- Businesses that bought compromised information and used it to extend credit. Consumers ultimately pay when businesses are defrauded.
- Regulators, who have been debating measures to weaken credit bureau accountability and the CFPB after being lobbied to the tune of $3 million per year by credit bureaus.
State requirements for notification ranges from 15 days to “without reasonable delay.” New European Union rules specify notification of a breach within 72 hours, and consumers may recover damages if proper notification isn’t
received.
Equifax’s response is wholly inadequate. First, it asked consumers to find out if they were victims by entering their information into an easily-cloned dedicated website - EquifaxSecurity2017.com. Then it accidentally directed Twitter users to a fake cloned site, SecurityEquifax2017.com.
Equifax’ insulting first offer was for free credit monitoring and fraud protection for a year - with fine print committing consumers to arbitration. Because a credit freeze is a far better option (though unpalatable for credit bureaus) Equifax
has now agreed to lift the “credit freeze” fees permitted in some states until
November 21. But consumers must freeze their credit at all four credit bureaus
in order to be protected, and may also be required to pay fees for “thawing” their own credit as needed ($0-&10 per bureau, per occurrence). Moreover, the security PINs required for thawing are reportedly easily guessed, leaving consumers confused about their best course of action.
Core issues to be considered and discussed below:
- Was Equifax negligent? Could the breach have been prevented? Was Equifax’ rapid expansion under Richard F Smith a factor?
- Should Equifax have notified consumers sooner? Have consumers even been notified?
- What risks do consumers face because of the breach?
- What economic compensation does Equifax owe consumers whose information was stolen? Businesses that relied on it?
- Should consumers have more rights over the sale of their personal data –including the right to opt out entirely from data sharing?
- What actions should consumers take, and what will it cost in time and money? Will inclusion in a class action suit prevent consumers from pursuing damages for actual economic harm later?
- What action should Equifax’ Board of Directors take? Should Equifax executives be fired and/or have past salary, bonuses and/or stock options "clawed back" into a victim compensation fund?