Credit monitoring company Equifax has revealed a major data breach that exposed the social security numbers and other sensitive information of approximately 143 million Americans. The Atlanta-based firm said that criminals exploited a US website application to access files between mid-May and July of this year.
The compromised data includes names, social security numbers, birth dates, addresses, and in some cases, driver's license numbers. Additionally, credit card numbers for about 209,000 US consumers were accessed. Equifax also reported that limited personal information of British and Canadian residents was taken, but no other countries are believed to be affected.
Equifax discovered the breach on 29 July but waited until Thursday to notify the public. In the interim, three senior executives sold shares worth nearly $1.8 million. Chief financial officer John Gamble sold shares worth $946,374, president of US information solutions Joseph Loughran exercised options to sell stock worth $584,099, and president of workforce solutions Rodolfo Ploder sold stock worth $250,458. Equifax stated that the executives had no knowledge of the intrusion at the time of their sales.
Following the public announcement, Equifax's share price dropped more than 13% in after-hours trading. The company has set up a website and a phone line for consumers to check if their information was stolen and is offering free credit monitoring. However, cybersecurity experts have criticised this response, with Proofpoint's Ryan Kalember calling it 'utterly farcical' and recommending that consumers place a security freeze on their credit reports.
Senator Mark Warner, vice-chairman of the senate intelligence committee, described the breach as 'profoundly troubling' and called for Congress to rethink data protection policies. This is not the first time Equifax has been targeted; in 2013, it confirmed unauthorised access to the financial files of four high-profile individuals.
