The breach compromised about 145.5 million people, although their level of exposure varied wildly. About 10.9 million Americans' driver's licenses were embroiled in the hack, and just a small fraction of the exposed UK licenses (just under 700,000) had enough info to jeopardize the victims' privacy.

Equifax stressed to CNN that the initial list of exposed data was never meant to be the final, definitive account of the scope of the problem. And that's not unheard of -- companies frequently deliver rough assessments of the damage in the immediate aftermath and refine the numbers as they learn more.

However, that explanation might not be enough for officials. Senators are already clamoring for a thorough investigation, and want to know the full extent of what happened. This update gives them more of what they want, but it also raises the question of why the company is still determining the scope of the breach nearly half a year after it was made public.