Equifax, the US credit ratings firm victim to an unlawful breach of security, has been told to inform British residents “at the earliest opportunity” if their personal information has been put at risk, the Information Commissioner said on Friday.
Equifax says it holds details on over 44 million Britons, and said that records of UK and Canadians citizens were among the unlawfully accessed confidential data for 143 million Americans.
“Reports of a significant data loss at US-based Equifax and the potential impact on some UK citizens gives us cause for concern. We are already in direct contact with Equifax to establish the facts including how many people in the UK have been affected and what kind of personal data may have been compromised,” ICO deputy commissioner James Dipple-Johnstone said.
“We will be advising Equifax to alert affected UK customers at the earliest opportunity. In cyber-attack cases that cross borders the ICO is committed to working with relevant overseas authorities on behalf of UK citizens.”
Equifax admitted on Thursday that data on its servers had been unlawfully accessed due to a vulnerability in its website.
“Equifax ... identified unauthorised access to limited personal information for certain UK and Canadian residents. Equifax will work with UK and Canadian regulators to determine appropriate next steps,” it said in its initial statement.
Since then, Equifax has released no further information on how many Britons have been affected, or what personal information was stolen, despite repeated requests for comment. In its communications with business customers, the company highlights the vast quantity of data it holds on the British public, including “over 44 million quality consumer names … updated monthly” in one marketing database and “over 10 million child data records” in another.
Lenders rely on the information collected by credit bureaus such as Equifax to help them decide whether to approve financing for homes, cars and credit cards.
Atlanta-based Equifax discovered the hack in July, but only informed consumers this week.
“This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do,” Equifax chief executive Richard Smith said in a statement.
“I apologise to consumers and our business customers for the concern and frustration this causes.”
It has since emerged that three Equifax executives sold shares worth a combined $1.8m (£1.3m) a few days after the company discovered it had been hacked. However, Equifax said the three executives “had no knowledge that an intrusion had occurred at the time they sold their shares”.
Cyber-attacks have become an increasing problem for big firms that hold a large amount of customer data. HSBC and TalkTalk are among the most high profile British firms to be targeted in recent years, the later of which was hit with a record £400k fine by ICO for its failings to protect customer data.
