Richard Smith offered apologies in testimony before House and Senate panels reviewing data breach that affected an estimated 145 million Americans

This article is more than 2 years old

This article is more than 2 years old

Equifax’s “lax attitude” to protecting consumers’ data came in for sharp criticism on Tuesday as Congress grilled the credit agency’s former chairman and CEO over the company’s failures in the wake of a massive data breach.

Equifax chief Richard Smith steps down in wake of massive data breach Read more

The credit company yesterday clarified that at least 145.5 million people had their personal details, including credit card numbers, social security details, addresses, emails, mother’s maiden names exposed after one of the biggest hacks in US history.

Former CEO Richard Smith outlined steps the credit reporting company is taking to regain the nation’s trust at an appearance before a House subcommittee on Tuesday morning, the first of several he will be making over the course of the week.

Equifax has been heavily criticised for its response to the breach and congressman Frank Pallone said Equifax had an “ongoing lax attitude when it comes to protecting consumer data”.

He warned Smith that “if Equifax wants to stay in business, its entire corporate culture needs to change to one that values security and transparency.”

Congressman Paul Tonko said American now faced “a lifetime of risk” because of Equifax’s errors.

At the hearing Smith blamed “human error and technology errors” for the breach which came after Equifax failed to apply a software patch that led to a breach of its systems.

“It’s like the guards at Fort Knox forgot to lock the doors and failed to notice the thieves were emptying the vaults,” Greg Walden, the chairman of the House energy and commerce committee, told Smith. “How does this happen when so much is at stake?” Walden said. “I don’t think we can pass a law that fixes stupid.”

Lawmakers including Elizabeth Warren are now pushing for tough new laws to regulate the credit agencies following the breach. On Tuesday Warren called the breach “inexcusable” and a “betrayal of consumers’ trust”.

In his testimony, Smith offered apologies, an explanation of how the company allowed the hacking to occur and what it is doing to limit the damage for consumers whose personal information, including social security numbers, birthdates and addresses, was stolen.



Smith said the company’s call centers were overwhelmed after the breach was announced on 7 September.

“Many needlessly waited on hold or were otherwise unable to have their questions answered through the call centers, which I deeply regret,” Smith said in his prepared remarks.

Equifax had 500 customer service representatives dedicated to customers before the breach. Adding to the company’s woes, two of the larger call centers in Florida were forced to temporarily close during Hurricane Irma. Now, the company has more than 2,500 customer service employees on duty and that number is growing, Smith said.

The company has also put in place a support package that includes free credit file monitoring, identity theft insurance and a credit lock that restricts access to a consumer’s credit report without their permission. A service that will be available by 31 January will allow consumers to lock and unlock their credit files repeatedly, for free, over the course of their lifetime.

Looking ahead, Smith said “this humbling experience has crystalized” the need for an industry standard that places access to credit data in the hands of the consumer. He said the company’s lifetime lock program should become the industry standard. Second, he said the country should begin discussing the replacement of social security numbers as the primary means to verify a consumer’s identity.

'It's hugely problematic': SEC under fire from Congress over data hack Read more

“It is time to have identity verification procedures that match the technological age in which we live,” Smith said.

Lawmakers are expected to grill Smith about why it took the company so long to notify the public after he was informed of “suspicious activity” on 31 July. In his prepared remarks, he is apologetic and said the millions affected are not just numbers in a database, but friends, family, neighbors and members of his church. He said accountability “starts at the top” and that was why he decided to step down as CEO and retire.

“Equifax was entrusted with Americans’ private data and we let them down,” Smith said.

The House subcommittee holding the hearing has jurisdiction over e-commerce and consumer protection issues.



