Credit monitoring company Equifax has been criticized by customers and security experts for an inadequate response to a data breach that included the personal information of up to 143 million Americans.
The hack was especially problematic because of the sensitivity of the information stolen, including names, social security numbers, addresses, birthdays and driver’s licence numbers – details that make it easy for cybercriminals to fraudulently assume victims’ identities.
Equifax has a website and hotline to handle customer questions about the breach, but it has been criticized for being unclear and ill-equipped to deal with the volume of incoming queries.
Equifax discovered the cyber-attack on 29 July but took five weeks to announce it publicly. On Thursday it published a link to an informational website and a hotline number for concerned customers to call to check if their personal data had been affected.
However, many callers were kept waiting, or would be randomly disconnected. Those who got through were told by outsourced call center agents to visit the website.
Another customer, Amy Yoakum, said that after nine disconnected calls she was put on hold for 23 minutes before reaching an operator.
“He said he is a contractor and had been instructed to direct everyone back to the website. He had no access to my account and told me all of the other agents were getting a lot of frustrated callers today,” she said.
When customers visited the website to see if their data had been compromised they were encouraged to sign up for a year’s worth of identity theft protection and free credit monitoring through the company’s TrustID Premier service.
“The CEO [Rick Smith] talks about taking the ‘unprecedented step’ to offer every US consumer a free year of service,” said John Peterson, a management consultant from Boston who was affected by the breach. “It’s really irrelevant when hackers have everything they need – name, date of birth, social security number, mother’s maiden name – to create a bogus credit line in your name at any point in the future.”
“This is a big deal, but the response has been underwhelming. I see no reason why the CEO shouldn’t step down,” he said.
Forrester security analyst Jeff Pollard called for more clarity from Equifax on what data has been compromised in the breach, given how sensitive it could be.
“When retailers get hit by a breach like this, it’s a single credit card that might get stolen, when Equifax it could be everything about the affected parties, and presumably linked to other things. We need more information from Equifax other than your information was or possibly was accessed,” he said.
‘A disingenuous attempt to limit liability’
Once customers signed up for the free service, many were perturbed to find in the small print a clause that prevented them from suing Equifax or entering into a class-action lawsuit.
“It’s a disingenuous attempt to limit liability,” Peterson said. “For individuals affected by this we recommend not signing up with Equifax monitoring services,” Pollard said.
A class-action lawsuit has been filed in Portland, Oregon, alleging that Equifax had been negligent in protecting customer data, opting to save money instead of developing technical safeguards against such a cyber-attack.
The suit was filed by Mary McHill from Portland and Brook Reinhard from Eugene on behalf of all those affected by the data breach. It claims that the lawsuit could have cost implications of $68.6bn.
“Equifax knew and should have known that failure to maintain adequate technological safeguards would eventually result in a massive data breach,” states the complaint, obtained by Cyberscoop. “Equifax could have and should have substantially increased the amount of money it spent to protect against cyber-attacks but chose not to.”
Several law firms – including Holzer & Holzer, Khang & Khang and Levi & Korsinsky – have launched investigations into potential securities law violations by Equifax.
“It is ideal, if ironic, for cybercriminals to compromise the very companies that internet users rely on to safeguard their identities and finances,” said security expert Kenneth Geers, a senior research scientist at Comodo. “Even if you are not a customer, Equifax likely has a lot of data about you, and you should take proactive steps in response to this hack.”
Equifax’s stock has fallen by more than 14% since the breach was made public on Thursday.
