Equifax breach: Criticism from lawmakers, what people can do

Associated Press

NEW YORK

There’s no way around it: The news from credit reporting company Equifax that 143 million Americans had their information exposed is extremely serious.

Crucial pieces of personal data that criminals could use to commit identity theft – Social Security numbers, birthdates, address histories, legal names – were all obtained. That’s information that cannot change. And once that data is out there, it’s basically out there forever.

“The crown jewels of personal information were exposed and potentially stolen,” said John Ulzheimer, an independent credit consultant who previously worked at Equifax.

Equifax’s key role in the financial industry makes this breach more alarming than previous ones at Yahoo or retailers. It’s a storehouse of personal information, like how much people owe on their houses and whether they have court judgments against them.

Lenders rely on the information collected by three big credit bureaus – Equifax, TransUnion and Experian – to help them decide whether to approve financing for homes, cars and credit cards. Credit checks are sometimes done by employers when deciding whom to hire for a job.

Atlanta-based Equifax said Thursday that “criminals” exploited a U.S. website application to access the files between mid-May and July of this year. It discovered the hack July 29, but waited until Thursday to warn consumers.

The enormity of the breach has put immense financial and political pressure on Equifax.

Washington regulators and politicians swiftly criticized Equifax, and Jeb Hensarling, chairman of the House Financial Services Committee, said he will call for Congressional hearings.

Equifax’s requirement that affected customers sign up for arbitration also drew a backlash. Democrats in the House and Senate called on the company to pull back its requirement that anyone who signs up for credit monitoring give up their right to sue Equifax in a class-action lawsuit.

“It’s shameful that Equifax would take advantage of victims by forcing people to sign over their rights in order to get credit-monitoring services they wouldn’t even need if Equifax hadn’t put them at risk in the first place,” said U.S. Sen. Sherrod Brown, D-Ohio.

“If Equifax is genuine about wanting to protect customers, it must remove forced arbitration immediately from TrustedID and any other services offered to victims of the data breach,” Brown said in a statement.