Equifax Breach Reporting Delays Caused Large Pains

The time a company takes to publicly announce they’ve been hacked is a source of great angst for consumers. Learning one’s sensitive data has been exposed while a business knowingly sits on the news can be infuriating. In the time it took Equifax to announce their breach, millions of customers had already lost the ability to act quickly to minimize their own damage. While companies acknowledge it takes time to get their ducks in a row after a breach, we’re expected to wait until they do. It may be pouring salt in a wound to know that on March 8, 2017, US businesses were warned by the Department of Homeland Security that a serious security bug existed–urging them to quickly apply a security patch. Apparently, Equifax took two months to do so. Failing to act quickly is exactly how the breach happened. Oops!

The Equifax hack made public in September of 2017 raises many questions to which there are few good answers. They finally acknowledged they were aware of the breach in May 2017 but did not go public until five months later. It was then they divulged 145 million US customers had their information stolen. It’s possible this was the most expensive hack in corporate history, costing Equifax an estimated $430+ million to bounce back. But what’s the cost to the little guy whose information, including financial data and social security numbers, has made its way for sale on the Dark Web? Equifax failed to estimate that cost. Over six months later in February 2018, they announced an additional 2.4 million customers had been compromised. Say what?

The goal behind waiting to announce a hack is self-preservation for the company–it’s a public relations nightmare. A data breach rattles consumer confidence, which translates into lost business. Companies claim they need time to discover what happened–how the breach occurred and how to prevent it from happening again. Then, they need to come up with a plan to restore their shaken credibility and ultimately their profits. Interesting that three Equifax executives sold company shares after discovering the breach but before it was made public.

There are currently no federal laws about how quickly a company must announce a security breach. Some 46 states now have their own regulations, but Georgia where Equifax is based, has no such laws. In fact, Equifax reportedly spent over $1 million dollars in 2016 to lobby against laws on data breaches and notification. It’s clear where the true motivation lies when a company delays announcing a data breach–personal and corporate profits. Individual customers caught in the hack can only cross their fingers and take steps to correct damage that’s long been done. Unfortunately, while we’re all waiting for companies to let us know, hackers can be using our information. The only advice in this situation is to check credit reports often, immediately report suspicious charges, and if possible, freeze your credit.

2

• If you have an account with Equifax, change the password for it immediately. It wasn’t disclosed as being part of this breach, but it’s always a good idea to do this after any breach. When doing so, be sure it is unique and not used on any other site. Hackers often try to reuse password and user name combinations on other sites once they have them.

• Next, while in the account settings changing your password, enable two-factor authentication (2FA) if you haven’t already. This will prevent anyone with malicious intent from requesting a password reset just using your email address and will keep them from getting into your account using just your password. If this option is available on any site, take advantage of it, even if the account doesn’t store sensitive information. People often think sites like Facebook, Twitter, LinkedIn, or Instagram don’t require use of 2FA because payment card details or social security numbers aren’t stored with them. However, those sites have so much information about users that they are extremely important to secure.

• Be sure to monitor credit reports regularly. Keeping an eye on these should be normal practice. They are available from each of the three bureaus for no charge one time per year. Everyone with credit should be checking them for suspicious activity throughout the year.

• Credit card information of approximately 209,000 people was also included in the stolen data. Be sure to monitor payment card statements diligently and report potential fraudulent charges to the card issuer right away.

• Be on the lookout for phishing emails that attempt to get you to click links or open attachments claiming they are somehow related to this incident. Often, these phishing campaigns ramp up to take advantage of news like this. If your information was included in this breach, don’t rely on an email to tell you. Check the website or wait to see if you receive a paper letter in the U.S. Mail from Equifax. In this case, assume any email messages you get claiming to be related to or supporting this Equifax breach in any way are phishing. Confirm legitimacy of links and attachments in some manner other than by using information provided in the email messages. Often, scammers will put phone numbers and email addresses in them, hoping you will respond using those. They actually staff locations to handle communication initiated from that information. Be wary of any messages, email, text, or chat that claim to provide a service for you as a victim of this incident.