Equifax: Breach exposed 143 million Social Security numbers and other data

Equifax Inc. said its systems were struck by a cyberattack that may have affected about 143 million U.S. customers of the credit reporting agency, shedding light on one of the largest and most intrusive breaches in history.

Intruders accessed names, Social Security numbers, birth dates, addresses and driver’s license numbers, Equifax said in a statement. Credit card numbers for about 209,000 consumers were also accessed, the company said. Equifax shares dropped more than 8 percent in after-hours trading.

“This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do. I apologize to consumers and our business customers for the concern and frustration this causes,” Chief Executive Officer Richard Smith said.

The company set up a website at www.equifaxsecurity2017.com for consumers to determine whether their information was compromised. It’s also offering free credit-file monitoring and identify-theft protection.

Guy Ball, a Tustin resident, submitted a report through Equifax’s site after he learned of the breach. He said the site didn’t tell him if he was hacked but signed him up for the free monitoring service.

“What really disappoints me is that Equifax is the big daddy of the credit industry,” he wrote via email. “Target and Home Depot, I can understand (sort of). But why can’t Equifax keep our personal information secure?”

The incident is a stark reminder of the risk of consumers’ personal data being exposed online. It’s particularly worrisome for the millions of people who trust credit-reporting agencies like Equifax to handle and protect their financial information.

Criminals took advantage of a “U.S. website application vulnerability to gain access to certain files” from mid-May through July of this year, Equifax said. The intruders also accessed dispute documents with personal identifying information for about 182,000 consumers.

“It’s a huge deal,” said Tim Crosby, senior consultant with security-assessment firm Spohn, “You would expect these guys to have compartmentalized this data far enough away from a Web server — that there would not be any way to directly access it.”

Equifax has been hit by breaches in the past. Experian Plc, Equifax and TransUnion, the three biggest U.S. credit-reporting companies, uncovered cases in 2013 where hackers gained illegal, unauthorized access to user information. Credit reports, purportedly on famous people ranging from Michelle Obama to Paris Hilton, were posted online in that hack.

This is the most high-profile cybersecurity breach since online portal Yahoo reported two separate incidents. Last year, Yahoo, whose web assets were acquired by Verizon Communications Inc. earlier this year, disclosed a 2014 breach that affected at least 500 million customer accounts. A few months later, the company said a 2013 hack siphoned email addresses, scrambled account passwords and dates of birth of as many as 1 billion users.