Equifax

Equifax was founded as the Retail Credit Company by Cator and Guy Woolford in Atlanta, Georgia, as Retail Credit Company in 1899.{{Cite web|title=Equifax|url=https://www.georgiaencyclopedia.org/articles/business-economy/equifax|access-date=2020-06-13|website=New Georgia Encyclopedia|language=en}} By 1920, the company had offices throughout the United States and Canada.{{Cite book|last=Anderson|first=Raymond|url=https://books.google.com/books?id=7LlGfPvOJLoC&q=by+1920%2C+equifax+had+offices+throughout+the+United+States+and+Canada&pg=PA49|title=The Credit Scoring Toolkit: Theory and Practice for Retail Credit Risk Management and Decision Automation|date=2007-08-30|publisher=OUP Oxford|isbn=978-0-19-922640-5|language=en}} By the 1960s, Retail Credit Company was one of the nation's largest credit bureaus, holding files on millions of American and Canadian citizens.{{Cite web|date=2017-09-18|title=Equifax breach just another page in the sordid history of credit bureaus|url=https://themortgagereports.com/31656/equifax-breach-sordid-history-of-credit-bureaus|access-date=2020-06-13|website=Mortgage Rates, Mortgage News and Strategy : The Mortgage Reports}} Even though the company continued to do credit reporting, the majority of its business was making reports to insurance companies when people applied for new insurance policies, such as life, auto, fire and medical insurance. RCC also investigated insurance claims and made employment reports when people were seeking new jobs. Most of the credit work was then being done by a subsidiary, Retailers Commercial Agency.

Retail Credit Company's information holdings and willingness to sell its information attracted criticism in the 1960s and 1970s. These included that it collected "...{{nbsp}}facts, statistics, inaccuracies and rumors ... about virtually every phase of a person's life; his marital troubles, jobs, school history, childhood, sex life, and political activities." The company was also alleged to reward its employees for collecting derogatory information on consumers.[https://www.wired.com/wired/archive/3.09/equifax.html "Separating Equifax from fiction"], Wired, September 1995, retrieved September 13, 2007 This led to discrimination against queer people and people of color.{{Cite web |title=The Equifax Way |url=https://jacobin.com/2017/09/equifax-retail-credit-company-discrimination-loans |access-date=2023-08-19 |website=jacobin.com |language=en-US}}

In 1970, after the company had computerized its records, which led to wider availability of the personal information it held, the U.S. Congress held hearings that led to the enactment of the Fair Credit Reporting Act. This legislation gave consumers rights regarding information stored about them in corporate databanks.{{Cite web|last=FTC|date=2020|title=A Summary of Your Rights Under the Fair Credit Reporting Act|url=https://www.consumer.ftc.gov/articles/pdf-0096-fair-credit-reporting-act.pdf|access-date=June 12, 2020|website=FTC|archive-date=June 21, 2020|archive-url=https://web.archive.org/web/20200621215908/https://www.consumer.ftc.gov/articles/pdf-0096-fair-credit-reporting-act.pdf|url-status=dead}} It is alleged that the hearings prompted the Retail Credit Company to change its name to Equifax in 1975 to improve its image.

Equifax expanded into commercial credit reports on companies in the United States, Canada and the UK, where it came into competition with companies such as Dun & Bradstreet and Experian.{{Cite web|title=Equifax Inc {{!}} Encyclopedia.com|url=https://www.encyclopedia.com/social-sciences-and-law/economics-business-and-labor/businesses-and-occupations/equifax-inc|access-date=2020-06-13|website=www.encyclopedia.com}} The insurance reporting was phased out.{{Citation needed|date=June 2020}} The company also had a division selling specialist credit information to the insurance industry but spun off this service, including the Comprehensive Loss Underwriting Exchange (CLUE) database as ChoicePoint in 1997.{{Cite web|last=SEC Archives|date=December 31, 2001|title=ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(D) OF THE SECURITIES EXCHANGE ACT OF 1934 FOR THE FISCAL YEAR ENDED DECEMBER 31, 2001|url=https://www.sec.gov/Archives/edgar/data/1040596/000095014402003091/g75084e10-k.txt|access-date=June 12, 2020|website=SEC}} Equifax formerly offered digital certification services, which it sold to GeoTrust in September 2001.{{Cite web|title=GeoTrust acquires Equifax's digital certificate business|url=https://www.bizjournals.com/atlanta/stories/2001/09/24/daily17.html|access-date=2020-06-13|website=www.bizjournals.com}} Also in 2001, Equifax spun off its payment services division, forming the publicly listed company Certegy, which subsequently acquired Fidelity National Information Services in 2006.{{Cite web|title=DEFINITIVE PROXY STATEMENTS RELATING TO MERGER OR ACQUISITION|url=https://www.sec.gov/Archives/edgar/data/1136893/000110465905060670/a05-17182_1prer14a.htm|access-date=2020-06-13|website=www.sec.gov}} Certegy effectively became a subsidiary of Fidelity National Financial as a result of this reverse acquisition merger (See Certegy and Fidelity National Information Services for further information).

In October 2010, Equifax announced it was acquiring Anakam, an identity verification software company headquartered in San Diego, California, which invented and pioneered SMS (text-message based) two-factor authentication. Terms of the deal were not disclosed.

Equifax purchased eThority, a business intelligence (BI) company headquartered in Charleston, South Carolina, in October 2011. eThority is partnering with TALX, a St. Louis-based business unit of Equifax, and remained in Charleston.{{cite news|last=Kearney|first=Brendan|title=Equifax buys local eThority: Company to stay, grow in Charleston, founder says|url=http://www.postandcourier.com/article/20111004/PC05/310049930|newspaper=The Post and Courier|date=October 4, 2011}}

In February 2016, Equifax acquired the Australasian company Veda, the largest credit reference agency in Australia at the time. Veda had previously acquired the Australian market research and opinion polling company ReachTEL in September 2015, which continues to produce opinion polls in Australia.{{cite web | title=Who controls opinion polling in Australia, what else we need to know about the polls, and why it matters |first=Murray| last=Goot| website=Inside Story | date=15 May 2019 | url=https://insidestory.org.au/who-controls-opinion-polling-in-australia/ |archive-url=https://ghostarchive.org/archive/20220211/https://insidestory.org.au/who-controls-opinion-polling-in-australia/ |archive-date=2022-02-11 |url-status=live| access-date=11 February 2022}}{{cbignore}}

Equifax was the subject of more than 57,000 consumer complaints to the Consumer Financial Protection Bureau from October 2012 to September 17, 2017, with most complaints relating to incomplete, inaccurate, outdated, or misattributed information held by the company.{{Cite news |date=September 18, 2017 |title=The Dizzying Number Of CFPB Complaints Against Equifax Since 2012 Should Infuriate You |language=en-US |work=Fast Company |url=https://www.fastcompany.com/40469235/the-dizzying-number-of-cfpb-complaints-against-equifax-since-2012-should-infuriate-you |access-date=September 18, 2017}}

In September 2017, Equifax announced a cyber-security breach, which it claims to have occurred between mid-May and July 2017,{{Citation |last=Equifax |title=Rick Smith, Chairman and CEO of Equifax, on Cybersecurity Incident Involving Consumer Data. |date=September 7, 2017 |url=https://www.youtube.com/watch?v=bh1gzJFVFLc |access-date=September 12, 2017}} where cybercriminals accessed approximately 145.5 million U.S. Equifax consumers' personal data, including their full names, Social Security numbers, birth dates, addresses, and driver license numbers. Equifax also confirmed at least 209,000 consumers' credit card credentials were taken in the attack. On March 1, 2018, Equifax announced that 2.4 million additional U.S. customers were affected by the breach,{{Cite news |title=Equifax just discovered 2.4M more account breaches |language=en |work=NBC News |url=https://www.nbcnews.com/business/business-news/equifax-identifies-additional-2-4-million-customers-hit-data-breach-n852226 |access-date=2018-03-01}} increasing the number of affected to 147.9 million Americans. The company claims to have discovered evidence of the cybercrime event on July 29, 2017. Residents in the United Kingdom (15.2 million) and Canada (about 19,000) were also impacted. The vulnerability which Chinese hackers leveraged was {{CVE|2017-5638}};{{Cite web |title=NVD - CVE-2017-5638 |url=https://nvd.nist.gov/vuln/detail/CVE-2017-5638 |website=nvd.nist.gov}} the hackers managed to stay in Equifax's systems undetected for approximately 134{{spaces}}days.{{Cite web |date=2017-09-16 |title=Equifax, Apache Struts, and CVE-2017-5638 vulnerability {{!}} Synopsys |url=https://www.synopsys.com/blogs/software-security/equifax-apache-struts-vulnerability-cve-2017-5638/ |access-date=2020-02-17 |website=Software Integrity Blog |language=en-US}}

In March 2018, the Security and Exchange Commission accused Jun Ying, Equifax's former CIO, of illicit insider trading, by selling company stock before the breach was publicly disclosed.{{Cite news |date=2019-07-19 |title=Equifax CIO Put '2 and 2 Together' Then Sold Stock, SEC Says |language=en |url=https://www.bloomberg.com/news/articles/2018-03-14/sec-says-former-equifax-executive-engaged-in-insider-trading |access-date=2019-07-20}} After an investigation by the FBI, Ying pleaded guilty, was sentenced to four months of prison plus a year of supervised release, and was fined $55,000.00 and ordered to pay restitution of $117,117.61 in June 2019.{{Cite web |date=2019-06-27 |title=Former Equifax employee sentenced for insider trading |url=https://www.justice.gov/usao-ndga/pr/former-equifax-employee-sentenced-insider-trading |access-date=2019-07-20 |website=www.justice.gov |language=en}}{{Cite web |title=Former Equifax Executive Gets 4 Months for Insider Trading | SecurityWeek.Com |url=https://www.securityweek.com/former-equifax-executive-gets-4-months-insider-trading |website=www.securityweek.com}} An Equifax manager, Sudhakar Reddy Bonthu, also pleaded guilty to insider trading and received a sentence of 8 months of home confinement.{{cite news |last=Saunders |first=Jessica |date=October 17, 2018 |title=Former Equifax manager sentenced to 8 months home confinement for insider trading |work=The Atlanta Business Chronicle |url=https://www.bizjournals.com/atlanta/news/2018/10/17/former-equifax-manager-sentenced-to-8-months-home.html}}{{Cite web |title=Ex-Equifax Manager Gets Home Confinement for Insider Trading | SecurityWeek.Com |url=https://www.securityweek.com/ex-equifax-manager-gets-home-confinement-insider-trading |website=www.securityweek.com}}

In July 2019, The New York Times, the New York Post and other media reported Equifax had agreed to pay approximately $650 million to settle with the Federal Trade Commission (FTC) to resolve investigations by several state attorneys general, the Consumer Financial Protection Bureau, the FTC, and a consumer class-action lawsuit related to the data breach.{{Cite news |last1=Cowley |first1=Stacy |last2=Eavis |first2=Peter |date=2019-07-19 |title=Equifax Is Said to Be Near $650 Million Settlement for Data Breach |language=en-US |work=The New York Times |url=https://www.nytimes.com/2019/07/19/business/equifax-data-breach-settlement.html |access-date=2019-07-20 |issn=0362-4331}}{{Cite web |date=2019-07-20 |title=Equifax agrees to pay $700M after massive data breach |url=https://nypost.com/2019/07/19/equifax-agrees-to-pay-700m-after-massive-data-breach/ |access-date=2019-07-20 |website=New York Post |language=en |agency=Associated Press}}{{Cite news |author=Continuing Coverage: Data Privacy|agency=Associated Press |title=Report: Equifax to pay $700 million in breach settlement |language=en |newspaper=The Atlanta Journal-Constitution |url=https://www.ajc.com/news/report-equifax-pay-700-million-breach-settlement/dAjWtK56pwScg9ZF18ININ/ |access-date=2019-07-20}}

By September 2019, however, Equifax had added qualifications and "hurdles" to its claims process which put in doubt whether the previously announced cash settlement of $125 per affected consumer would actually be awarded.{{Cite news |last=Warzel |first=Charlie |date=2019-09-16 |title=Opinion {{!}} Equifax Doesn't Want You to Get Your $125. Here's What You Can Do. |language=en-US |work=The New York Times |url=https://www.nytimes.com/2019/09/16/opinion/equifax-settlement.html |access-date=2019-09-16 |issn=0362-4331}}{{Cite web |title=Want that $125 from Equifax? Don't ignore the company's latest email |url=https://www.cbsnews.com/news/equifax-breach-settlement-if-you-want-that-125-or-less-dont-ignore-the-equifax-email/ |access-date=2019-09-16 |website=www.cbsnews.com |date=September 10, 2019 |language=en-US}}{{Cite web |title=That $125 payment from Equifax? You shouldn't count on it |url=https://www.cbsnews.com/news/equifax-breach-settlement-2019-that-125-payment-from-equifax-heres-why-you-shouldnt-count-on-it/ |access-date=2019-09-16 |website=www.cbsnews.com |date=July 31, 2019 |language=en-US}}

On 19 December 2019, a federal judge in Atlanta awarded class-action attorneys representing consumers approximately $77.5 million, suggesting that individual consumers might expect to receive around six or seven dollars.{{Cite web |last=Leonhardt |first=Megan |date=2019-12-19 |title=If you made a claim for $125 from Equifax, you're not getting it after court awards nearly $80 million to attorneys |url=https://www.cnbc.com/2019/12/19/court-awards-80-million-to-consumer-attorneys-in-equifax-case.html |access-date=2019-12-20 |website=CNBC |language=en}}

In July 2020, Equifax reported that, after purchasing Ansonia Credit Data (Ansonia), a major source of consumer credit, payments, and invoice receivables (AR) data used by financial companies and other borrowers and businesses in the shipping and logistics sectors, the firm has expanded its position in commercial payment technology solutions.{{Cite web|date=27 July 2020|title=Equifax acquires Ansonia expanding leadership in commercial credit data solutions|url=https://ibsintelligence.com/ibs-journal/ibs-news/equifax-acquires-ansonia-expanding-leadership-in-commercial-credit-data-solutions/|access-date=28 July 2020|website=IBSIntelligence|archive-date=July 28, 2020|archive-url=https://web.archive.org/web/20200728022100/https://ibsintelligence.com/ibs-journal/ibs-news/equifax-acquires-ansonia-expanding-leadership-in-commercial-credit-data-solutions/|url-status=dead}}

On 2 August 2022, a week after its CEO Mark Begor was deemed "uniquely qualified to lead the Company" and was granted a $25 million bonus package by Equifax's board, the Wall Street Journal reported that Equifax had sent millions of incorrectly calculated credit scores to lenders.{{Cite news |last=Andriotis |first=Andrew Ackerman and AnnaMaria |date=2022-08-02 |title=WSJ News Exclusive {{!}} Equifax Sent Lenders Inaccurate Credit Scores on Millions of Consumers |language=en-US |work=Wall Street Journal |url=https://www.wsj.com/articles/equifax-sent-lenders-inaccurate-credit-scores-on-millions-of-consumers-11659467483 |access-date=2022-08-03 |issn=0099-9660}}{{Cite web |author=Alexandra Peers |date=August 3, 2022 |title=Equifax issued wrong credit scores for millions |url=https://www.cnn.com/2022/08/03/business/equifax-wrong-credit-scores/index.html |access-date=2022-08-03 |website=CNN}} Equifax acknowledged reporting inaccurate credit scores, but insisted the errors had affected only a few people. The following day, a class-action lawsuit was filed by Jacksonville, Florida resident Nydia Jenkins against Equifax alleging she had received a "substantially pricier car loan" (resulting in an additional loan payment of $2,352 more per year) due to Equifax reporting her credit score 130 points off from what it should have been.{{Cite web |title=Jenkins v. Equifax - Complaint.pdf |url=https://drive.google.com/file/d/1nT63LlVMp4Bzznw8yc078vvJXvjxUpVI/view?usp=embed_facebook |access-date=2022-08-04 |website=Google Docs}}{{Cite web |title=Equifax sued over erroneous credit scores sent for "millions" of Americans |url=https://www.cbsnews.com/news/equifax-lawsuit-wrong-credit-score/ |access-date=2022-08-04 |website=www.cbsnews.com |date=August 4, 2022 |language=en-US}}

In February 2023, it was announced Equifax had acquired the Barueri-headquartered credit bureau, Boa Vista Serviços for $596 million,{{Cite web |date=2023-02-10 |title=Equifax to acquire Brazilian credit bureau Boa Vista Serviços for $596m |url=https://www.nsbanking.com/news/equifax-to-acquire-boa-vista-servicos/ |access-date=2023-02-10 |website=NS Banking |language=en-US}} starting to trade on the B3 in São Paulo, under the symbol EFXB31.

Equifax primarily operates in the business-to-business sector, selling consumer credit and insurance reports and related analytics to businesses in a range of industries.{{Citation needed|date=September 2007}} Business customers include retailers, insurance firms, healthcare providers, utilities, government agencies, as well as banks, credit unions, personal and specialty finance companies and other financial institutions.{{Citation needed|date=June 2020}} Equifax sells businesses credit reports, analytics, demographic data, and software.{{Cite book|last=Gupta|first=Rohit|url=https://books.google.com/books?id=l7R9DwAAQBAJ&q=Equifax+sells+businesses+credit+reports%2C+analytics%2C+demographic+data%2C+and+software&pg=PT98|title=Reward and Donation Crowdfunding: A Complete Guide for Emerging Startups|date=2018-12-06|publisher=Notion Press|isbn=978-1-68466-089-6|language=en}} Credit reports provide detailed information on the personal credit and payment history of individuals, indicating how they have honored financial obligations such as paying bills or repaying a loan. Credit grantors use this information to decide what sort of products or services to offer their customers, and on what terms. Equifax also provides commercial credit reports containing financial and non-financial data on businesses of all sizes. Equifax collects and provides data through the National Consumer Telecom and Utilities Exchange (NCTUE), an exchange of non-credit data including consumer payment history on telecommunications and utility accounts.{{cite news|url=https://www.nytimes.com/2018/09/14/your-money/credit-freeze-free.html|title=Freezing Credit Will Now Be Free. Here's Why You Should Go for It.|newspaper=The New York Times|author=Ann Carrns|date=14 September 2018|access-date=22 September 2018}}{{cite news|url=https://krebsonsecurity.com/2018/05/another-credit-freeze-target-nctue-com/|title=Think You've Got Your Credit Freezes Covered? Think Again.|publisher=KrebsonSecurity|author=Brian Krebs|date=9 May 2018|access-date=22 September 2018|author-link=Brian Krebs}}

In 1999, Equifax began offering services to the credit consumer sector in addition, such as credit fraud and identity theft prevention products. Equifax and other credit monitoring agencies are required by law to provide US residents with one free credit file disclosure every 12 months; the Annualcreditreport.com website incorporates data from U.S. Equifax credit records.

Equifax also offers fraud prevention products based on device fingerprinting such as "FraudIQ Authenticate Device."

Equifax also offers a credit protection service, called Equifax Protect.{{Cite web |last=Levingston |first=Rebecca |date=2022-10-16 |title=Have you heard of 'Equifax'? |url=https://www.abc.net.au/brisbane/programs/mornings/olivia-maragna-equifax/101546714 |access-date=2023-05-18 |website=ABC Brisbane |language=en-AU}}

According to senator Michael Crapo, "The amount of data that the private industry and Government collect and store is very concerning. There is intrinsic vulnerability in collecting and storing personal financial information, and we need to have a meaningful discussion on how to protect and limit access to it."{{Cite web|title=- AN EXAMINATION OF THE EQUIFAX CYBERSECURITY BREACH|url=https://www.govinfo.gov/content/pkg/CHRG-115shrg28123/html/CHRG-115shrg28123.htm|access-date=2020-06-13|website=www.govinfo.gov}}

According to an October 2017 report from Motherboard, around December 2016, a security researcher examining Equifax's servers found that an online portal, created for Equifax employees only, was accessible to the open Internet.

{{blockquote|text="I didn't have to do anything fancy," the researcher told Motherboard, explaining that the site was vulnerable to a basic "forced browsing" bug. The researcher requested anonymity out of professional concerns. "All you had to do was put in a search term and get millions of results, just instantly—in cleartext, through a web app," they said. In total, the researcher downloaded the data of hundreds of thousands of Americans in order to show Equifax the vulnerabilities within its systems. They said they could have downloaded the data of all of Equifax's customers in 10 minutes: "I've seen a lot of bad things, but not this bad."|source=Motherboard}}

The same types of sensitive private information of American consumers (names, birth dates, social security numbers, etc.) were exposed as in the May–July breach, according to Motherboard. Additionally, the security researchers said they were able to gain shell access on Equifax's servers and discovered and reported to Equifax additional vulnerabilities. According to the reporting, despite receiving this warning from the security researcher, the affected portal was not closed until six months later in June, well after the March and May–July breaches had begun.{{Cite news|url=https://www.vice.com/en/article/equifax-breach-social-security-numbers-researcher-warning/|title=Breaking: Equifax Knew of Security Flaws Months Before It Was Hacked|date=2017-10-26|work=Motherboard|access-date=2017-10-29|language=en-us}} Moreover, the employee portal was reportedly not the same server targeted in the later breaches, which Motherboard speculates may suggest multiple breaches by more than one party may have occurred.

On September 18, 2017, Bloomberg News reported that Equifax had been the victim of a "major breach of its computer systems" in March 2017, and that in early March it had begun "notifying a small number of outsiders and banking customers" about this attack.Riley, Michael, Anita Sharpe, and Jordan Robertson, [https://www.bloomberg.com/news/articles/2017-09-18/equifax-is-said-to-suffer-a-hack-earlier-than-the-date-disclosed "Equifax Suffered a Hack Almost Five Months Earlier Than the Date It Disclosed"], Bloomberg News, September 18/19, 2017.

According to Bloomberg, a person familiar with the breach believed this early-March intrusion may have been carried out by the same party that breached Equifax's computer systems again in May. According to Bloomberg, Equifax enlisted Mandiant (owned by FireEye, Inc.) to assist in investigating the March attack. The same cybersecurity firm was hired following the May–July breach.

{{main|2017 Equifax data breach}}

Between May and July 2017, currently unidentified hackers were able to use a known exploit on one of Equifax' web servers that had yet to be updated to access the credit records of more than 140 million Americans as well as some British and Canadian citizens before the breach was detected and shut down. Equifax disclosed the breach on September 7, 2017, after determining the means and scope of the breach.{{Cite web|url=https://www.cnbc.com/2017/09/07/credit-reporting-firm-equifax-says-cybersecurity-incident-could-potentially-affect-143-million-us-consumers.html|title=Credit reporting firm Equifax says cybersecurity incident could potentially affect 143 million US consumers|last=Haselton|first=Todd|date=September 7, 2017|website=cnbc.com|access-date=September 8, 2017}} The event was considered "one of the biggest data breaches in history."[https://venturebeat.com/2017/11/04/the-end-of-the-cloud-is-coming/ "The end of the cloud is coming"], VentureBeat, Victor Charypar, November 4, 2017

Several consumers filed lawsuits in small-claims court against Equifax due to the breach, while Equifax later came to a $575 million settlement with the Federal Trade Commission to offer either a cash payment or credit monitoring for those affected by the breach.{{Cite web|url=https://www.ftc.gov/news-events/press-releases/2019/07/equifax-pay-575-million-part-settlement-ftc-cfpb-states-related|title=Equifax to Pay $575 Million as Part of Settlement with FTC, CFPB, and States Related to 2017 Data Breach|date=2019-07-19|website=Federal Trade Commission|language=en|access-date=2019-07-25}} The data from the breach has yet to be seen on black markets or the dark web by security experts, making it difficult to identify the origin of the breach. However, in February 2020, the United States Department of Justice indicted four members of China's People's Liberation Army on nine charges related to the breach, which China has denied.{{cite web | url = https://www.nytimes.com/2020/02/10/us/politics/equifax-hack-china.html | title = U.S. Charges Chinese Military Officers in 2017 Equifax Hacking | first= Katie | last = Benner | date = February 10, 2020 | access-date = February 10, 2020 | work = The New York Times }}{{cite web | url = https://www.cbsnews.com/news/china-denies-responsibility-in-equifax-breach-after-doj-charges-four-military-members/ | title = Data from Equifax credit hack could "end up on the black market," expert warns | date= February 11, 2020 | access-date = February 11, 2020 | work = CBS News }}

In September 2017, Brian Krebs revealed that the Argentine arm of Equifax had left private data from approximately 14,000 consumers, and more than 100 staff members, available to anyone who entered "admin" as both the username and password for one of its online systems.{{cite web|url=https://www.cnet.com/news/equifax-argentina-vulnerability-admin/|title=Equifax reportedly used 'admin' as password in Argentina|website=Cnet.com|access-date=September 16, 2017}}{{cite web|url=https://www.bbc.co.uk/news/technology-41257576|title=Equifax suffers fresh data breach|date=September 13, 2017|website=BBC News|access-date=September 16, 2017}}

On September 7, 2017, the same day as Equifax announced a large security breach, Equifax removed its official mobile apps from the Apple App Store and from Google Play.{{cite web|url=https://www.fastcompany.com/40466121/equifaxs-app-has-disappeared-from-apples-app-store-and-google-play|title=Equifax's app has disappeared from Apple's App Store and Google Play|date=September 11, 2017|website=Fastcompany.com|access-date=September 16, 2017}} While these apps themselves were not reportedly connected to that breach, they had security flaws of their own, being vulnerable to man-in-the-middle attacks owing to some parts using HTTP instead of HTTPS.{{cite web|url=https://www.fastcompany.com/40468811/heres-why-equifax-yanked-its-apps-from-apple-and-google-last-week|title=Here's Why Equifax Yanked Its Apps From Apple And Google Last Week|date=September 15, 2017|work=Fast Company|access-date=September 16, 2017}}

On October 8, 2017, Krebs reported that The Work Number, a website operated by Equifax's TALX division, exposed the salary histories for employees of tens of thousands of US companies to anyone in possession of the employee's Social Security Number and date of birth.{{cite web|url=https://krebsonsecurity.com/2017/10/equifax-breach-fallout-your-salary-history/|title=Equifax Breach Fallout: Your Salary History — Krebs on Security|website=krebsonsecurity.com|date=October 9, 2017 |access-date=October 11, 2017}}{{cite web|url=https://boingboing.net/2017/10/10/fucking-muppets.html|title=Equifax will give your salary history to anyone with your SSN and date of birth / Boing Boing|website=boingboing.net|date=October 10, 2017 |access-date=October 11, 2017}} For roughly half the US population, both of the latter pieces of data are known to be in possession of criminals, following Equifax's May–July 2017 security breach. In July 2019, Equifax settled with the Federal Trade Commission for $700 million. This number contains a $380,500,000 consumer restitution fund, part of the class action lawsuit.{{cite web |last1=Statt |first1=Nick |title=Equifax owes you a lot more, but here's how to get $125 from this week's settlement |url=https://www.theverge.com/2019/7/25/8930233/equifax-data-breach-ftc-settlement-claim-sign-up-how-to |website=The Verge |date=July 25, 2019 |access-date=2 August 2019}}

On October 12, 2017, Equifax's website was reported to have been offering visitors malware via drive-by download.{{cite news|last1=Goodin|first1=Dan|title=Equifax website hacked again, this time to redirect to fake Flash update|url=https://arstechnica.com/information-technology/2017/10/equifax-website-hacked-again-this-time-to-redirect-to-fake-flash-update/|access-date=October 12, 2017|work=Ars Technica|date=October 12, 2017|language=en-us}}{{cite news|last1=Schroeder|first1=Stan|title=Equifax may have been hacked again and it's not even funny anymore|url=http://mashable.com/2017/10/12/equifax-website-hack/#LwptAbtQtqqn|access-date=October 12, 2017|work=Mashable|language=en}} The malware was disguised as an update for Adobe Flash.{{cite news|last1=Humphries|first1=Matthew|title=Equifax Website Hacked Again|url=https://www.pcmag.com/news/356736/equifax-website-hacked-again|access-date=October 12, 2017|work=PCMAG|language=en}}{{Cite news|url=https://www.latimes.com/business/la-fi-equifax-social-security-numbers-20171012-story.html|title=Equifax website is apparently hacked|last1=Puzzanghera|first1=Jim|date=October 12, 2017|work=Los Angeles Times|access-date=October 12, 2017|last2=Raab|first2=Lauren|language=en-US|issn=0458-3035}} At that time, only 3 out of 65 top anti-malware products provided protection against the particular malware, meaning that many visitors were at risk of having their computers infected when visiting the Equifax website.

On October 13, 2017, the attack was revealed to have been performed by hijacking third-party analytics JavaScript from Digital River brand FireClick.{{cite news|last1=Goodin|first1=Dan|title=Equifax rival TransUnion also sends site visitors to malicious pages|url=https://arstechnica.co.uk/information-technology/2017/10/equifax-rival-transunion-also-sends-site-visitors-to-malicious-pages/|access-date=October 13, 2017|work=Ars Technica UK|language=en-us}}{{cite news|last1=Kovacs|first1=Eduard|title=Malicious Redirects on Equifax, TransUnion Sites Caused by Third-Party Script {{!}} SecurityWeek.Com|url=http://www.securityweek.com/malicious-redirects-equifax-transunion-sites-caused-third-party-script|access-date=October 13, 2017|work=www.securityweek.com|language=en}}

Also on October 13, 2017, the U.S. Internal Revenue Service was reported to have suspended a $7.2 million contract with Equifax as a result of the attack.{{cite web|last1=David|first1=Kravets|title=After second bungle, IRS suspends Equifax's "taxpayer identity" contract|url=https://arstechnica.com/tech-policy/2017/10/after-second-bungle-irs-suspends-equifaxs-taxpayer-identity-contract/|website=Ars Technica|access-date=October 16, 2017|language=en-us|date=October 13, 2017}}

In 1982, Retail Credit Company was criticized for collecting "...facts, statistics, inaccuracies and rumors... about virtually every phase of a person's life; his marital troubles, jobs, school history, childhood, sex life, and political activities."WIRED Magazine referenced a March 1970 edition of The New York Times, which included an article by Columbia University Professor Alan Westin. No specific date or article is referenced. Simson Garfinkel, [http://www.wired.com/wired/archive/3.09/equifax.html Separating Equifax from Fiction], September 1995.

The company was charged with rewarding its employees for collecting negative information on consumers in the 1970s. There was a consent decree. In 1975 the company changed its name to "Equifax"—reportedly to counteract its tarnished reputation.Simson Garfinkel, [http://www.wired.com/wired/archive/3.09/equifax.html Separating Equifax from Fiction], WIRED Magazine, September 1995.

The company has been fined by the Federal Trade Commission on two occasions for violating the Fair Credit Reporting Act ("FCRA"). In 2000, Equifax, along with Experian and TransUnion, was fined $2.5 million for blocking and delaying phone calls from consumers trying to get information about their credit. In 2003, the FTC took Equifax to court for the same reason and settled its lawsuit with the company for a fine of $250,000.[http://www.nbc10.com/consumeralert/2373170/detail.html Equifax Fined $250,000 Fine By FTC] {{webarchive|url=https://web.archive.org/web/20081007050948/http://www.nbc10.com/consumeralert/2373170/detail.html |date=October 7, 2008 }}, NBC 10, August 3, 2003, retrieved September 13, 2007{{cite news |title=Equifax to Pay $250,000 to Settle Charges |publisher=ConsumerAffairs.com |date=July 30, 2003 |url=http://www.consumeraffairs.com/news03/equifax.html |access-date=July 23, 2007 |url-status=dead |archive-url=https://web.archive.org/web/20070817015805/http://www.consumeraffairs.com/news03/equifax.html |archive-date=August 17, 2007 }}

In July 2013, a federal jury in Oregon awarded $18.6 million to Julie Miller of Marion County against Equifax for violations of the Fair Credit Reporting Act.{{cite news | url=https://www.stltoday.com/news/local/crime-and-courts/excuse-me-i-m-not-dead-st-louis-county-woman/article_9802cd07-8bea-59ba-b7fe-a5fc3b051482.html | title='Excuse me, I'm not dead' St. Louis County woman pleads to her bank | newspaper=St. Louis Post-Dispatch | date=February 8, 2014 | access-date=February 18, 2014 | author=Patrick, Robert}} In her lawsuit, Miller alleged Equifax had merged her credit reports with another person with a different Social Security number, date of birth, and address. Miller contacted Equifax repeatedly in writing and over the telephone, but Equifax refused to delete dozens of false collection accounts from Miller's credit report.{{cite news | url=https://www.nytimes.com/2013/08/03/your-money/credit-scores/credit-bureaus-willing-to-tolerate-errors-experts-say.html?pagewanted=2&_r=0/ | title=An $18 Million Lesson in Handling Credit Report Errors | access-date=August 2, 2013 | work=The New York Times | date=August 2, 2013}} The award included $18.4 million in punitive damages, and $180,000 in compensatory damages. Miller's lawyer, Justin Baxter, explained that the false reporting damaged Miller's reputation, she was denied credit, and her private information was given to businesses Miller had no relationship with.{{cite news|url=http://www.oregonlive.com/business/index.ssf/2013/07/equifax_must_pay_186_million_a.html/ |title=Equifax must pay $18.6 million after failing to fix Oregon woman's credit report |access-date=July 26, 2013 |work=The Oregonian |url-status=dead |archive-url=https://archive.today/20130729153030/http://www.oregonlive.com/business/index.ssf/2013/07/equifax_must_pay_186_million_a.html |archive-date=July 29, 2013 }} The jury's verdict is believed to be the largest award in an individual case under the Fair Credit Reporting Act.{{cite web | url=https://abcnews.go.com/Business/equifax-loses-186-million-lawsuit/story?id=19803421/ | archive-url=https://archive.today/20131215045323/http://abcnews.go.com/Business/equifax-loses-186-million-lawsuit/story?id=19803421/ | url-status=dead | archive-date=December 15, 2013 | title=Jury Awards $18.6M For Equifax Credit Report Mix-up |website = ABC News| access-date=July 29, 2013}} An Equifax spokesperson said that Equifax is considering appealing the jury's verdict.{{cite web | url=http://www.ajc.com/news/business/equifax-weighs-appealing-186m-awardto-consumer/nY65r/ | title=Equifax weighs appealing $18.6M award to consumer|website=Ajc.com | access-date=July 31, 2013}} A federal judge reduced the award to $1.62 million in 2014.{{cite web | url=http://www.oregonlive.com/business/index.ssf/2014/01/judge_cuts_oregon_womans_award.html| title=Judge cuts Oregon woman's award in Equifax case |website=Oregonlive.com| date=January 30, 2014 | access-date=February 3, 2015}}

In 2014, Equifax and Heartland Bank were sued by Kimberly Haman of the St. Louis area for reporting she was dead.{{cite magazine | url=http://www.abajournal.com/news/article/woman_sues_in_effort_to_prove_she_is_alive/ | title=Woman sues in effort to prove she is alive | magazine=ABA Journal | date=February 11, 2014 | access-date=February 18, 2014 | author=Weiss, Debra Cassens}}{{cite news | url=https://blogs.wsj.com/law/2014/02/10/woman-listed-as-deceased-files-lawsuit-claiming-shes-alive/ | title=Woman Listed as Deceased Files Lawsuit Claiming She's Alive | publisher=Wall Street Journal Law Blog | date=February 10, 2014 | access-date=February 18, 2014 | author=Gershman, Jacob}} A Heartland Bank spokesperson said the bank "immediately investigated and contacted the credit reporting agencies after Haman reported" she was still alive. An Equifax "spokesperson told the Post-Dispatch that Equifax blocked the Heartland account information from appearing on Haman's credit report after a reporter's inquiry."

In April 2014, Equifax was sued in New York federal court by God Gazarov, who claimed the company erroneously reports him as having no credit history because of his unusual first name.{{cite web | url=https://www.nbcnews.com/business/business-news/god-just-wants-some-credit-so-hes-suing-equifax-n78226 | title=God Just Wants Some Credit, So He's Suing Equifax | work=NBC News | date=April 11, 2014 | access-date=April 22, 2014 | author=White, Martha C.}} Gazarov settled his lawsuit in May 2015, with Equifax agreeing to enter his name into their database.{{Cite web |date=2015-05-29 |title=Man with 1st name 'God' settles with credit rating agency |url=https://apnews.com/article/8fbde0167e664211935b1a441dcdd4c7 |url-status=live |archive-url=https://web.archive.org/web/20231030030845/https://apnews.com/article/8fbde0167e664211935b1a441dcdd4c7 |archive-date=2023-10-30 |access-date=2023-10-30 |website=AP News |language=en}}

On November 4, 2017, it was reported that a group of five Oklahomans had sued the company, claiming that Equifax "violated laws which require financial institutions to protect the security of their customers' personal information."[http://www.newson6.com/story/36765689/oklahomans-file-lawsuit-against-equifax "Oklahomans File Lawsuit Against Equifax"], NewsOn6, November 4, 2017 Equifax selected the law firm DLA Piper to work on the case in D.C. It had turned to Edelman for earlier crisis control after the October 2017 privacy breach.[https://www.odwyerpr.com/story/public/9606/2017-10-23/equifax-picks-dla-piper.html "Equifax Picks DLA Piper"], Kevin McCauley, O'Dwyer's, October 23, 2017

Consumer lawsuits claiming damages under the FCRA have been successful in small claims court.{{cite news|url=https://finance.yahoo.com/news/people-beating-equifax-appeals-court-winning-thousands-210943746.html?guccounter=1|title=Equifax is losing appeals|work=Yahoo Finance|date=March 9, 2018}}

Equifax software engineer Sudhakar Reddy was charged with insider trading for purchasing options prior to the disclosure of the 2017 data breach.{{cite news |url=https://www.politico.com/story/2018/06/28/former-equifax-manager-insider-trading-680781 |website=Politico |title=Former Equifax manager charged with insider trading linked to cyber breach |first=Colin |last=Wilhelm |date=June 28, 2018 |quote=The SEC says Bonthu bought options before the company's data breach became public and sold them for a profit of more than $75,000}}{{cite news |url=https://www.sec.gov/news/press-release/2018-115 |publisher=U.S. Securities and Exchange Commission |title=Former Equifax Manager Charged With Insider Trading |date=June 28, 2018 |quote=In a complaint filed in federal court in Atlanta today, the SEC charged that Equifax software engineering manager Sudhakar Reddy Bonthu traded on confidential information he received while creating a website for consumers impacted by a data breach.}}

In January 2020, Equifax agreed to a global settlement with the Federal Trade Commission, the Consumer Financial Protection Bureau, and 50 U.S. states and territories. For those that were affected by the data breach, there were open suggestions to file claims against it. The settlement includes up to $425 million to help people affected by the data breach.{{Cite web|url=https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement|title=Equifax Data Breach Settlement|date=2019-07-11|website=Federal Trade Commission|language=en|access-date=2020-04-12}}{{usgovpd}}{{Cite web|date=2019-07-11|title=Equifax Data Breach Settlement|url=https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement|access-date=2021-05-04|website=Federal Trade Commission|language=en}} Equifax ultimately reached a settlement with regulators for up to $700 million.{{Cite news|last=Bernard|first=Tara Siegel|url=https://www.nytimes.com/2020/01/22/business/equifax-breach-settlement.html|title=Equifax Breach Affected 147 Million, but Most Sit Out Settlement|date=2020-01-22|work=The New York Times|access-date=2020-04-13|language=en-US|issn=0362-4331}}

In October 2023, the UK's Financial Conduct Authority fined Equifax more than £11 million for failing to secure UK customer data.{{Cite web |date=2023-10-12 |title=Financial watchdog fines Equifax Ltd £11 million for role in one of the largest cyber security breaches in history |url=https://www.fca.org.uk/news/press-releases/equifax-ltd-fine-cyber-security-breach |url-status=live |archive-url=https://web.archive.org/web/20231022132010/https://www.fca.org.uk/news/press-releases/equifax-ltd-fine-cyber-security-breach |archive-date=2023-10-22 |access-date=2023-10-30 |website=Financial Conduct Authority |language=en}}

In May 2024, mortgage lenders First Financial Lending and Greystone Mortgage filed a proposed class-action lawsuit against Equifax, accusing the company of monopolizing the market for electronic income and employment verification services, allegedly leading to higher prices.{{Cite web |last=Nunes |first=Flávia Furlan |date=2024-05-31 |title=Lenders file class-action lawsuit against Equifax, citing monopoly in work number product |url=https://www.housingwire.com/articles/lenders-file-class-action-lawsuit-against-equifax-citing-monopoly-in-work-number-product/ |url-status=live |archive-url=http://web.archive.org/web/20240531165000/https://www.housingwire.com/articles/lenders-file-class-action-lawsuit-against-equifax-citing-monopoly-in-work-number-product/ |archive-date=2024-05-31 |access-date=2024-06-03 |website=HousingWire |language=en-US}}{{Cite news |last=Scarcella |first=Mike |date=2024-05-29 |title=Equifax hit with antitrust class action over work verification services |url=https://www.reuters.com/legal/litigation/equifax-hit-with-antitrust-class-action-over-work-verification-services-2024-05-29/ |url-status=live |archive-url=http://web.archive.org/web/20240529215825/https://www.reuters.com/legal/litigation/equifax-hit-with-antitrust-class-action-over-work-verification-services-2024-05-29/ |archive-date=2024-05-29 |access-date=2024-06-03 |work=Reuters}}

• Compuscan
• Chinese cyberwarfare
• Chinese espionage in the United States
• Credit bureau
• Credit score
• Experian
• Fair Credit Reporting Act
• Identity theft
• Innovis
• Privacy laws of the United States
• Talx
• The Work Number
• TransUnion

{{Reflist}}

• {{Official website|https://www.equifax.com}}
• [https://web.archive.org/web/20121020053708/http://www.identityprotection.com/ Equifax Consumer Identity Protection website]
• [https://eligibility.equifaxbreachsettlement.com/en/eligibility 2019 Eligibility site related to 2017 data breach]

{{Finance links

| name = Equifax Inc.

| symbol = EFX

| sec_cik = 33185

| yahoo = EFX

| google = EFX:NYSE

}}

{{Atlanta companies|collapsed}}

{{Authority control}}

Category:Companies listed on the New York Stock Exchange

Category:American companies established in 1899

Category:Financial services companies established in 1899

Category:Financial services companies of the United States

Category:Former certificate authorities

Category:Companies based in Atlanta

Category:Corruption in the United States

Category:Credit scoring

Category:Data brokers