Equifax

Equifax Inc.
	File:Equifax Logo.svg Equifax logo
Company type	Public
Industry	Consumer credit reporting
Founded	January 1, 1899; 127 years ago in Atlanta, Georgia, U.S.
Founder	Cator and Guy Woolford
Headquarters	Atlanta, United States
Area served	Worldwide (24 countries in Americas, Europe, Asia Pacific)
Key people	Mark Begor (CEO)
Products	Credit reports, credit monitoring services, fraud prevention tools, credit and demographic data analytics
Number of employees	14,000+
Website	www.equifax.com

Equifax Inc. stands as a prominent American multinational firm specializing in consumer credit reporting, with its main office located in Atlanta, Georgia. It is recognized as one of the "Big Three" credit reporting agencies, alongside Experian and TransUnion. Equifax compiles information on more than 800 million consumers and 88 million businesses worldwide. Its primary offerings encompass credit and demographic data analytics, credit monitoring services, and fraud prevention tools designed for both corporate clients and individual consumers.

With operations spanning 24 countries across the Americas, Europe, and the Asia Pacific region, Equifax employs upwards of 14,000 personnel globally. The company generates close to US$5 billion in yearly revenue and is listed on the New York Stock Exchange under the ticker symbol EFX.

History

Originally established as the Retail Credit Company by Cator and Guy Woolford in Atlanta, Georgia in 1899, Equifax had expanded to multiple offices throughout the United States and Canada by 1920. By the 1960s, Retail Credit Company ranked among the largest credit bureaus, maintaining records on millions of consumers across North America. While continuing its credit reporting activities, a significant portion of its operations involved supplying reports to insurance firms for underwriting new policies and conducting employment background checks. The credit reporting function was mainly managed through a subsidiary known as Retailers Commercial Agency.

During the 1960s and 1970s, the company encountered criticism over its extensive collection of personal data, including sensitive life details, which sparked accusations of discriminatory practices against minority populations. Congressional hearings held in 1970—triggered by concerns over computerized record-keeping and data accessibility—led to the enactment of the Fair Credit Reporting Act, which provided consumers with protections regarding their personal information. In an effort to revamp its public image, the company rebranded itself as Equifax in 1975.

Equifax broadened its scope through acquisitions in healthcare profiling and claims evaluation sectors, including HealthChex Inc., Osborn Laboratories, and Electronic Tabulating Services in 1994. It also expanded its commercial credit reporting services within the United States, Canada, and the United Kingdom, competing directly with Dun & Bradstreet and Experian. The company eventually phased out its insurance reporting division, spinning off specialized insurance credit services into ChoicePoint in 1997. In 2001, Equifax divested its digital certification business to GeoTrust and separated its payment processing unit as Certegy, which subsequently merged with Fidelity National Information Services.

In October 2010, Equifax acquired Anakam, a San Diego-based firm specializing in identity verification software focused on SMS-based two-factor authentication. The following year in October 2011, it purchased eThority, a Charleston-based business intelligence company aimed at strengthening its analytics capabilities.

In February 2016, Equifax acquired Veda, then Australia’s largest credit reference agency. Veda had previously absorbed market research company ReachTEL.

Between October 2012 and September 2017, Equifax received over 57,000 consumer complaints related to inaccuracies or outdated information on their reports.

In September 2017, Equifax revealed a significant cybersecurity breach that impacted roughly 147.9 million U.S. consumers along with individuals in the United Kingdom and Canada. The breach compromised sensitive personal information such as Social Security numbers and driver’s license data. Attackers from China exploited a known vulnerability (CVE-2017-5638), remaining undetected for approximately 134 days.

In March 2018, former Chief Information Officer Jun Ying faced charges from the SEC for insider trading connected to stock sales prior to public disclosure of the breach; he pleaded guilty and received prison time along with fines. Another executive also admitted guilt for insider trading offenses.

By July 2019, Equifax agreed to pay nearly $650 million to resolve investigations conducted by federal regulators and state attorneys general concerning the breach. However, changes introduced by September 2019 to the claims process raised doubts about consumer compensation initially estimated at $125 per affected person. In December 2019, courts awarded class-action attorneys $77.5 million while individual consumers were expected to receive only modest payments.

In July 2020, Equifax enhanced its commercial credit data offerings by acquiring Ansonia Credit Data, thereby improving services tailored to financial institutions and logistics companies.

Following CEO Mark Begor’s receipt of a $25 million bonus for strategic leadership in August 2022, Equifax disclosed that it had sent inaccurate credit scores to lenders affecting millions of individuals. This led to a class-action lawsuit alleging financial damages resulting from erroneous scoring.

In February 2023, Equifax expanded into Latin America through its acquisition of Brazilian credit bureau Boa Vista Serviços for $596 million. Boa Vista is publicly traded on São Paulo’s B3 stock exchange under the symbol EFXB31.

Products

Equifax primarily serves the business-to-business market by delivering consumer credit and insurance reports, along with analytics and software solutions, to a diverse range of industries. Its clientele encompasses retailers, insurance companies, healthcare organizations, utility providers, government entities, banks, credit unions, personal and specialty finance firms, as well as other financial institutions. The company provides credit reports that outline individuals' payment histories and financial commitments, which lenders utilize to assess product eligibility and terms. In addition, Equifax offers commercial credit reports containing both financial and non-financial information about businesses of varying sizes.

Data is gathered through the National Consumer Telecom and Utilities Exchange (NCTUE), which tracks consumer payment records related to telecommunications and utility services. Since 1999, Equifax has broadened its scope into the consumer credit market by introducing products focused on fraud prevention and identity theft protection. Under U.S. law, residents are entitled to one complimentary annual credit report via Annualcreditreport.com, which incorporates data from Equifax.

The company's suite of fraud prevention tools features device fingerprinting technology, including the "FraudIQ Authenticate Device" system. Moreover, Equifax provides a credit protection offering marketed as Equifax Protect.

Security failings

Senator Michael Crapo raised concerns regarding the extensive personal financial data amassed and maintained by private companies and government agencies, underscoring the necessity for enhanced safeguards and restricted access to such sensitive information.

2016 advance warnings of insecure systems

In December 2016, a security expert identified that an online portal intended exclusively for Equifax employees was inadvertently accessible over the public Internet due to a simple "forced browsing" flaw. To illustrate the vulnerability's severity, the researcher downloaded data relating to hundreds of thousands of U.S. consumers, highlighting that all customer information could have been extracted within ten minutes. The exposed dataset contained highly sensitive personal details such as names, dates of birth, and Social Security numbers—the very types of data compromised during the May to July 2017 breach.

The researcher also obtained shell access to Equifax’s servers and uncovered further security weaknesses. Despite these alerts, Equifax did not deactivate the vulnerable portal until June 2017, several months after breaches in March and May–July had commenced. Reportedly, this portal was distinct from the server implicated in later attacks, indicating that multiple intrusions were conducted by different threat actors.

March 2017 security breach

In September 2017, Bloomberg News disclosed that Equifax experienced a significant cybersecurity incident in March 2017. Early that month, the company began informing certain external parties and banking clients about this breach. It is suspected that the same attacker was behind both the March incident and the subsequent breaches occurring between May and July.

To investigate the March event, Equifax enlisted cybersecurity firm Mandiant, a subsidiary of FireEye, Inc.. This firm was also retained following the larger-scale breaches spanning May through July.

Data breach from May to July 2017

During the period from May through July 2017, cybercriminals took advantage of an unpatched security flaw on an Equifax web server, gaining unauthorized access to credit information belonging to more than 140 million U.S. consumers, along with certain British and Canadian individuals. Equifax publicly revealed the breach on September 7, 2017, after thoroughly evaluating the extent of the intrusion. This event ranks among the most significant data breaches ever recorded.

As a consequence, Equifax faced a multitude of legal actions and ultimately consented to a $575 million settlement with the Federal Trade Commission, which included options for affected individuals to receive monetary compensation or credit monitoring services. Despite comprehensive investigations, the compromised data has not appeared on illicit marketplaces or within dark web forums. In February 2020, the U.S. Department of Justice charged four members of the Chinese military in connection with the breach; these accusations were denied by China.

Exposure of Argentine consumer information in 2017

In September 2017, Equifax’s Argentine branch inadvertently revealed confidential information belonging to approximately 14,000 consumers and over 100 employees due to a system protected only by the default login credentials "admin." This incident underscored persistent cybersecurity vulnerabilities within Equifax’s international operations.

Removal of insecure mobile applications in 2017

On September 7, 2017—the same day Equifax announced its major data breach—the company withdrew its official mobile applications from both the Apple App Store and Google Play. Although these apps were not directly connected to the breach, they contained security weaknesses because certain components transmitted data via HTTP instead of HTTPS, leaving users susceptible to man-in-the-middle attacks.

Disclosure of U.S. employee salary information in 2017

On October 8, 2017, it was uncovered that The Work Number—a website managed by Equifax’s TALX division—exposed salary records of employees from thousands of American companies to anyone possessing an employee’s Social Security number and birth date. This vulnerability was exacerbated by the earlier Equifax breach that compromised such personal identifiers for nearly half of the U.S. population. In July 2019, Equifax reached a $700 million settlement with the Federal Trade Commission, which included a $380.5 million fund for consumer restitution related to class action litigation.

Malware distribution via website

On October 12, 2017, Equifax’s website was discovered distributing malware disguised as an Adobe Flash update through drive-by download attacks. At that time, only three out of sixty-five top anti-malware programs detected this threat, putting numerous visitors at risk. The source was traced back to compromised third-party analytics JavaScript from Digital River’s FireClick brand. Following this event, on October 13, 2017, the U.S. Internal Revenue Service suspended a $7.2 million contract with Equifax.

Criticism

In 1982, Retail Credit Company faced scrutiny for compiling extensive personal data, including sensitive details about individuals’ private lives. During the 1970s, the company was accused of encouraging employees to collect adverse consumer information as a performance incentive, resulting in a consent decree. To rehabilitate its tarnished image, it rebranded as "Equifax" in 1975.

Lawsuits and fines

Equifax has been subjected to multiple penalties by the Federal Trade Commission (FTC) for breaches of the Fair Credit Reporting Act (FCRA). In 2000, Equifax, along with Experian and TransUnion, was collectively penalized $2.5 million for hindering consumer access to their credit information. Later, in 2003, Equifax resolved another FTC lawsuit by paying a $250,000 fine related to similar infractions.

In July 2013, a federal jury awarded Julie Miller $18.6 million due to Equifax’s failure to rectify merged credit reports, constituting one of the largest individual FCRA damage awards. This amount included $18.4 million in punitive damages but was subsequently reduced by a judge in 2014 to $1.62 million.

During 2014, Equifax encountered lawsuits such as the case brought by Kimberly Haman, who was mistakenly reported as deceased, and God Gazarov, who filed suit over credit reporting inaccuracies tied to his uncommon first name; the latter dispute was settled in 2015 with Equifax correcting its records.

Following the 2017 cybersecurity breach, residents of Oklahoma initiated lawsuits against Equifax for inadequate protection of personal data. Equifax retained the legal services of DLA Piper and Edelman for defense and crisis management efforts. Consumer claims under the FCRA have also seen favorable outcomes in small claims courts.

In 2018, an Equifax software engineer faced insider trading charges after purchasing options prior to the public disclosure of the breach.

By January 2020, Equifax reached a comprehensive settlement with the FTC, Consumer Financial Protection Bureau, and authorities from 50 states and territories, dedicating up to $425 million to compensate affected consumers. The total settlement sum was around $700 million.

In October 2023, the Financial Conduct Authority in the United Kingdom imposed a fine exceeding £11 million on Equifax for insufficient safeguarding of UK customer data.

In May 2024, First Financial Lending and Greystone Mortgage—both mortgage lenders—filed a class-action suit accusing Equifax of monopolizing electronic income and employment verification services. They claim this monopoly has led to inflated prices, underscoring ongoing legal disputes impacting Equifax’s business operations and market presence.

External links