The Equifax Inc. offices in Atlanta. (AP Photo/Mike Stewart)

The Equifax Inc. offices in Atlanta. (AP Photo/Mike Stewart)

Equifax breach exposes 143 million people to identity theft

By Michael Liedtke / Associated Press

SAN FRANCISCO — Credit monitoring company Equifax has been hit by a high-tech heist that exposed the Social Security numbers and other sensitive information about 143 million Americans. Now the unwitting victims have to worry about the threat of having their identities stolen.

The Atlanta-based company, one of three major U.S. credit bureaus, said Thursday that “criminals” exploited a U.S. website application to access files between mid-May and July of this year.

The theft obtained consumers’ names, Social Security numbers, birth dates, addresses and, in some cases, driver’s license numbers. The purloined data can be enough for crooks to hijack the identities of people whose credentials were stolen through no fault of their own, potentially wreaking havoc on their lives. Equifax said its core credit-reporting databases don’t appear to have been breached.

“On a scale of one to 10, this is a 10 in terms of potential identity theft,” said Gartner security analyst Avivah Litan. “Credit bureaus keep so much data about us that affects almost everything we do.”

Lenders rely on the information collected by the credit bureaus to help them decide whether to approve financing for homes, cars and credit cards. Credit checks are even sometimes done by employers when deciding whom to hire for a job.

Equifax discovered the hack July 29, but waited until Thursday to warn consumers. The Atlanta-based company declined to comment on that delay or anything else beyond its published statement. It’s not unusual for U.S. authorities to ask a company hit in a major hack to delay public notice so that investigators can pursue the perpetrators.

The company established a website, www.equifaxsecurity2017.com, where people can check to see if their personal information may have been stolen. Consumers can also call 866-447-7559 for more information. Experian is also offering free credit monitoring to all U.S. consumers for a year.

”This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do,” Equifax CEO Richard Smith said in a statement. “I apologize to consumers and our business customers for the concern and frustration this causes.”

This isn’t the biggest data breach in history. That indignity still belongs to Yahoo, which was targeted in at least two separate digital burglaries that affected more than 1 billion of its users’ accounts throughout the world.

But no Social Security numbers or drivers’ license information were disclosed in the Yahoo break-in.

Equifax’s security lapse could be the largest theft involving Social Security numbers, one of the most common methods used to confirm a person’s identity in the U.S. It eclipses a 2015 hack at health insurer Anthem Inc. that involved the Social Security numbers of about 80 million people .

Any data breach threatens to tarnish a company’s reputation, but it is especially mortifying for Equifax, whose entire business revolves around providing a clear financial profile of consumers that lenders and other businesses can trust.

“This really undermines their credibility,” Litan said. It also could undermine the integrity of the information stockpiled by two other major credit bureaus, Experian and TransUnion, since they hold virtually all the data that Equifax does, Litan said.

Equifax’s stock dropped 13 percent to $124.10 in extended trading after its announcement of the breach.

Three Equifax executives sold shares worth a combined $1.8 million just a few days after the company discovered it had been hacked, according to documents filed with securities regulators.

The sales, executed on August 1 and August 2, were made by: John Gamble, Equifax’s chief financial officer; Rodolfo Ploder, Equifax’s president of workforce solutions; and Joseph Loughran, Equifax’s president of U.S. information solutions. Bloomberg News first reported the divestitures.

In a subsequent statement, Equifax said the three executives “had no knowledge that an intrusion had occurred at the time they sold their shares.”

The potential aftershocks of the Equifax breach should make it clear that Social Security numbers are becoming an unreliable way to verify a person’s identity, Nathaniel Gleicher, the former director of cybersecurity policy in the White House during the Obama administration, said in an email statement.

“This breach might just have put the nail in the coffin of the idea that we can use personal identifiers like Social Security numbers as security factors,” wrote Gleicher, who now oversees cybersecurity strategy for computer security firm Illumio.

In addition to the personal information stolen in its breach, Equifax said the credit card numbers for about 209,000 U.S. consumers were also taken, as were “certain dispute documents” containing personal information for approximately 182,000 U.S. individuals.

Equifax warned that hackers also may have some “limited personal information” about British and Canadian residents. The company doesn’t believe that consumers from any other countries were affected.

Talk to us

More in Herald Business Journal

Funko warehouse in Everett. (Kevin Clark / The Herald)
Funko to close Everett warehouses, shift work to Arizona

The company headquarters are currently in downtown Everett, but distribution will move to a Phoenix suburb.

FILE - In this Monday, March 1, 2021 file photo, The first Alaska Airlines passenger flight on a Boeing 737-9 Max airplane takes off on a flight to San Diego from Seattle-Tacoma International Airport in Seattle. A Boeing pilot involved in testing the 737 Max jetliner was indicted Thursday, Oct. 14,2021 by a federal grand jury on charges of deceiving safety regulators who were evaluating the plane, which was later involved in two deadly crashes. (AP Photo/Ted S. Warren, File)
Alaska Airlines to add Boeing 737s to the Paine Field fleet

It’s a sign of the growing popularity of flying from Everett. So far, much smaller Embraer E175s have been the rule.

FILE - Washington Attorney General Bob Ferguson talks to reporters, Monday, Aug. 26, 2019, during a news conference in Seattle. In a 5-4 decision Thursday, Jan. 20, 2022, the Washington Supreme Court upheld an $18 million campaign finance penalty against the Consumer Brands Association, formerly known as the Grocery Manufacturers Association. Ferguson sued the group in 2013, alleging that it spent $11 million to oppose a ballot initiative without registering as a political committee or disclosing the source of the money. (AP Photo/Ted S. Warren)
Washington justices uphold $18M fine in GMO-labeling case

Big grocers funneled dark money into a campaign against genetically modified labels on food packaging.

Mara Wiltshire, left, celebrates her first place finish in Mario Cart against her son Miles Jenkins, 7, as Calvin Jenkins, 5, looking on Friday evening at their home in Everett, Washington on January 7, 2022.  (Kevin Clark / The Herald)
Child care’s heightened burden takes parents out of workforce

One Snohomish County mom said she couldn’t return to work “because I didn’t have child care and I wouldn’t be able to afford it.”

In this photo taken May 17, 2017, wine barrels are shown at a vineyard adjacent to the Walla Walla Vintners winery in Walla Walla, Wash. The remote southeastern Washington town of Walla Walla - which used to be best known for sweet onions and as home of the state penitentiary - has now reinvented itself into a center of premium wines and wine tourism. (AP Photo/Nicholas K. Geranios)
More sustainable Washington wines are on the way

Labels will indicate grape growers met guidelines in 9 areas, including water, pest and labor practices.

A sign bearing the corporate logo hangs in the window of a Starbucks open only to take-away customers in this photograph taken Monday, April 26, 2021, in southeast Denver.  Starbucks is no longer requiring its U.S. workers to be vaccinated against COVID-19, reversing a policy it announced earlier this month. The Seattle coffee giant says, Wednesday, Jan. 19, 2022,  it's responding to last week’s ruling by the U.S. Supreme Court.  (AP Photo/David Zalubowski)
Starbucks nixes vaccine mandate after Supreme Court ruling

The move reverses a policy the coffee company announced earlier this month.

Logo for news use featuring the municipality of Stanwood in Snohomish County, Washington. 220118
Regulators OK doubling of composting operation in Stanwood

Lenz Enterprises can now handle 150,000 tons a year. Residents worry odors will be a problem.

Christian Sayre
Everett bar owner arrested again on new sexual assault charges

Christian Sayre, longtime owner of The Anchor Pub, was charged Friday with 10 counts of felony sex offenses.

FILE - Bill Gates speaks during the Global Investment Summit at the Science Museum, London, Tuesday, Oct, 19, 2021. A small city in the top U.S. coal-mining state of Wyoming will be home to a Bill Gates-backed experimental nuclear power project near a coal-fired power plant that will soon close, officials announced Tuesday, Nov. 16, 2021. (Leon Neal/Pool Photo via AP, File)
Microsoft to review workplace harassment, including Bill Gates allegations

One engineer wrote in a letter that she had a sexual relationship with Gates over several years.

Most Read