Equifax's 143-million-person data breach exposed Social Security numbers, birth dates, and driver's licenses. The breach ran from May to July before discovery. Equifax's CFO sold nearly $1 million in stock three days after the breach was discovered, raising questions about what executives knew.
Chapters
Is your personal information possibly at risk? Equifax targeted by a cyberattack affecting half of the US population. Tracy Carrasco now with the details in Washington. Tracy.
Good morning, Maria. Now, the real irony here is that Equifax is one of the largest agencies in the United States that many people use to guard against identity theft. But now 143 million customers are being placed in a compromising position— with their private information in the hands of cyber criminals. Although we are just hearing about this now, Equifax says the massive breach was discovered on July 29th. It includes sensitive information such as Social Security numbers, birthdays, addresses, and even driver's license numbers. It also said 209,000 credit card numbers were exposed in the breach, which includes customers in Canada and the United Kingdom. However, Equifax says its core credit card reporting database was not affected. The hackers gained access to certain files in the company's system from mid-May to July by exploiting a weak point in website software. That's according to an investigation by Equifax and security consultants. And even if you don't think you're a customer of Equifax, there's still a strong possibility they have your data. As a credit card reporting agency, Equifax Experian says it collects information from credit card companies, banks, lenders, and retailers to help it determine a person's credit score. Now, in a video message to customers, here is what Chairman and CEO Richard Smith said.
This is clearly a disappointing event and one that strikes at the heart of who we are and what we do. I deeply regret this incident, and I apologize to every affected consumer, and all of our partners.
Equifax is offering every consumer in the United States a comprehensive package of identity theft protection and credit card monitoring for free. To enroll, visit www.equifaxsecurity2017.com. It has also set up a call center, but here is what else you can do. Security experts say, you know, it's not a bad idea to check in with Equifax rivals like Experian and TransUnion. Check your credit cards and other accounts for suspicious activity. Change your passwords and also be careful opening any questionable emails that claim to be updates from Equifax or about the breach. Now, Maria, I reached out to Equifax to ask how many people affected in this data breach may have been given a free membership from other companies or retailers that experienced their own security breaches, but a spokesperson would not answer my question.
I think you bring up a really good point, Tracy, because we were just talking about this during the commercial break. When there was a breach recently, Equifax comes to you and says, sorry about the breach, here's a free account.
Exactly.
And because of that, they actually exposed themselves because they got a free, free account from Equifax.
People turning to them for protection are now caught up in all of this.
Tracy, thank you. Want to bring in cybersecurity expert right now with Hotspot Shield. Robert Siciliano. Robert, good to see you. Thanks for joining us. What about that? How can victims of Equifax, this breach, protect themselves? And what about this angle that many of these people didn't even want to be part of Equifax's portfolio and they were given free accounts?
Yeah, this is just messy all around. The fact that their domain is, you know, EquifaxSecurity2017.com, it should be EquifaxFail.com. They messed up big time here. Consumers are at a loss. They cannot rely on the government agencies or corporations to protect them from identity theft. Ultimately, the responsibility lies on you and I. I actually am a victim of this particular crime. I did a search on the website this morning, and yes, in fact, my social and my name showed up, and they're requesting that I sign up for their free credit monitoring. That being said, Uh, one of the main things, or most important things, that consumers should do is get what's called a credit freeze. So a credit freeze, which you get through the credit bureaus, uh, is another layer of protection that locks down your social on your credit report, essentially preventing a lender from getting your credit scores. If they can't get your scores, they're not gonna, uh, extend any credit. If they're not gonna extend any credit, to a certain degree, your identity is protected from new account fraud with a credit freeze.
Yeah, I mean, this is, this is half of the country, Kevin Kelly.
I mean, this— and I know you have other news that we want to also bring out here, but, but go ahead.
Yeah, this, this is unbelievable. I mean, one of the things on, uh, Labor Day, I saw an ad from Experian saying, hey, is your information on the dark web? Sign up for a free trial. When they— so they ran an ad for it, but they already knew they had been breached on the 29th. And what's fascinating is they knew on the 29th and 3 days later, in a regulatory filing, their CFO sold just under $1 million worth of shares. The CFO. That's unbelievable.
Yeah, it really is.
And which day did he do that?
3 days after they discovered it.
What? This is incredible. So the CFO sold stock 3 days after they discovered it. And yesterday the stock was down 13%. Yes. Now, the company is saying he didn't know anything about it when he sold the stock. Yet, yeah, what the company is—
the issue though is he's an executive, he's a CFO, he would have to know. Executive management knows when something this big happens.
But because the information is shared that we don't know about, I mean, this requires so much of the consumer to do their own due diligence on themselves, right? I mean, his experience of going on and finding out whether you were affected by this, um, how does a company deal with that?
Yeah, Robert Siciliano, final word from you. How worried should people be this morning?
Well, this is the most sensitive of personal identifying information— names, birth dates, driver's license numbers, and of course your Social Security number. The most important thing again here is get a credit freeze. Of course, always pay attention to your credit card statements. You know, a couple hundred thousand credit cards being compromised. Download your credit card company or bank's mobile app and get alerts and notifications for every single charge.
All right, we will leave it there. Robert, thanks very much for your insights this morning. We appreciate it. Robert Siciliano.
