Equifax has not told the whole story when it comes to its massive security breach first reported last September, Sen. Elizabeth Warren (D-MA) says. Over the last five months, her office investigated the breach and presented its findings in a new report, "Bad Credit: Uncovering Equifax's failure to protect Americans' personal information." In summation, Warren told Marketplace Tech's Molly Wood, "What they did was worse, a whole lot worse, than they originally admitted."
On Sept. 7. 2017, Equifax, one of the country's largest credit reporting agencies, revealed an astronomical breach on their part affecting approximately 145 million people — one of the biggest data breaches in history. Personal and sensitive information was exposed because of the data security lapse, including social security numbers, addresses and credit records.
Now, Warren is saying that not only did Equifax downplay the extent of the breach and stumble when it came to informing consumers about the hack, but also, that "Equifax is still making money off their own breach."
After interrogating Equifax executives during Senate hearings, engaging independent experts and questioning federal regulators and other credit-reporting agencies, Warren, with Sen. Mark Warner (D-Va.), is introducing legislation that would penalize security breaches at Equifax or other credit-rating agencies. Warren wants to ensure that Equifax, or any credit-reporting agency, makes security a priority, and moreover, that these companies will face consequences for their failures.
Warren said:
Clearly they failed badly here. And the problem is there's no real penalty for them. You know, it's not like consumers can say, 'Well, that's it. I'm never going to do business with Equifax again.' That's not how it works with credit-reporting agencies. In fact, Equifax may actually make money off this breach because it sells all these credit-protection devices, and even consumers who say, 'Hey, I'm never doing business with Equifax again,' well, good for you, but you go buy credit protection from someone else, they very well may be using Equifax to do the back office part. So Equifax is still making money off their own breach.
Warren and Warner propose a policy called "strict liability," which if a data breach took place, companies would be forced to pay $100 for the theft of the first piece of data, and $50 "for the theft of every following piece of data for every consumer whose data is stolen up to potentially half the value of the company," she told Marketplace Tech.
"All they do is collect data and package that data up and then sell it, and if they won't take basic care with that data, then they're making a profit by putting everybody else in America at risk," Warren added. "And that has to stop."
Shares