The Equifax Breach Continues to Rage

Patterson Belknap Webb & Tyler LLP

Six months after a massive data breach at credit reporting company Equifax, Inc. handed hackers the personal information of nearly 150 million Americans, the fallout continues. Equifax first disclosed in September that hackers used a flaw in its website software to extract the personal information of as many as 145.5 million people. The stolen data included names, Social Security numbers, birth dates, addresses, and driver’s license numbers. In just the first two months following the breach, Equifax incurred $87.5 million of expenses, and that number is now expected to grow to $439 million by the end of 2018, making this, potentially, the most expensive reported data breach to date.

The company is subject to information requests or investigations by all 50 state attorneys general, the U.S. Department of Justice, the U.S. Securities and Exchange Commission, the Federal Trade Commission, the Consumer Financial Protection Bureau, as well as international regulators. And as we reported here and here, the New York Department of Financial Services (DFS) and Secretary of State are investigating as well. The company is also subject to more than 350 class action law suits arising from the data breach, which are currently pending in Georgia, where Equifax is headquartered.

And the news keeps getting worse. On Thursday, Equifax said that more U.S. consumers were affected than originally disclosed.  The company identified about 2.4 million additional U.S. consumers whose names and partial driver’s license information were stolen, and revealed that the consumers affected “were not in the previously identified” population of cyberattack victims. That brings the total number of U.S. consumers whose personal information was compromised by the breach to 147.9 million.  This is the second time that Equifax has revised that number based on “continuing analysis.”

The latest disclosure could not come at a worse time for Equifax. Just last month, an industry study reported that 16.7 million U.S. consumers had their identities compromised in 2017, resulting in $16.8 billion in losses. That number of affected people was up 8% from 2016 and, according to the consulting firm that conducted the study, was the highest since 2003.  According to the same study, the Equifax breach, nearly unprecedented it is size, increased overall fraud figures for 2017.  At the same time, regulators continue to scrutinize and take action against companies that have been subject to cyberattacks, as evidenced by Pennsylvania’s recent suit against Uber—the third by a state attorney general—for its long-undisclosed data breach.

The company is also facing the ire of Congress. Following Equifax’s latest disclosure, members of the Senate and House Commerce Committee said they want even more information from Equifax and its cybersecurity contractor, Mandiant Corp. The request expands a congressional probe of Equifax’s handling of the breach and its cybersecurity systems. Some lawmakers have not stopped there. Senator Elizabeth Warren, one of the most vocal members of Congress on this breach, says that Equifax has not told the whole story when it comes to the breach. Since the breach was first reported, her office issued an investigatory report, entitled “Bad Credit: Uncovering Equifax’s failure to protect Americans’ personal information,” and Senator Warren now accuses the company of intentionally profiting from its own data breach. Warren, with Senator Mark Warner, also introduced legislation in January that would impose stiff financial penalties and strict liability on credit reporting companies for data breaches.

Stay tuned for further developments.


DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Patterson Belknap Webb & Tyler LLP | Attorney Advertising

Written by:

Patterson Belknap Webb & Tyler LLP

Patterson Belknap Webb & Tyler LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.