What's happening?
Shares of consumer credit bureau Equifax Inc. (EFX +1.52%) are down by about 12% as of 3:10 p.m. EDT as the company deals with fallout from a data breach that exposed the personal information -- including names, addresses, dates of birth, and Social Security numbers -- of as many as 143 million people to hackers.
So what
Equifax's No. 1 job is keeping its records safe from outsiders. It failed in that duty when, from mid-May through July 2017, criminals exploited vulnerabilities in its website to access the personal information of millions of people. The company learned of the unauthorized access on July 29 and notified the public on September 7.
Already dozens of class action lawsuits have been filed against Equifax. The state of Massachusetts may become the first state to file a lawsuit on behalf of its residents who were affected by the data breach, according to an official statement.
Equifax's data breach is already bringing costly lawsuits and prying eyes. Image source: Getty Images.
A group of 36 U.S. Senators piled on by penning a letter to the Securities and Exchange Commission, Department of Justice, and Federal Trade Commission, calling for an investigation into Equifax executives who sold shares of the company's stock after the breach was discovered, but before it was disclosed to the public.The prying eyes of three-letter government agencies and an upset American public rarely forms the basis for a pretty stock chart.
In an Op-Ed published by USA Today, Equifax Chairman and CEO wrote about the company's decision to delay the announcement of the data breach for so long, suggesting that the company originally thought the data breach and its impact was "limited" in its scope.
Understandably, many people are questioning why it took six weeks to report the incident to the public. Shortly after discovering the intrusion, we engaged a leading cybersecurity firm to conduct an investigation.
At the time, we thought the intrusion was limited. The team, working with Equifax Security personnel, devoted thousands of hours during the following weeks to investigate.
Now what
Prior to the disclosure of the data breach, Equifax's market value stood at $17.2 billion. Its market cap has since declined by about $4.9 billion, to $12.3 billion, reflecting the risk of costly lawsuits, settlements with governments and regulators, as well as lost revenue and profits from a tarnished brand.
Punishment enough? It's not exactly clear. With 143 million people affected by the data breach, Equifax's valuation has declined by about $34.30 for every person whose sensitive information was exposed. According to Bloomberg, Anthem previously settled a class action lawsuit over a data breach that exposed similar personal information of as many as 78.8 million Americans, equating to about $1.46 per person impacted. Of course, Equifax's problem is much bigger, more publicized, and the extent of the damage to individuals is not yet known.
One thing is certain: The actual costs to Equifax will likely go well beyond the financial costs of lawsuits and potential settlements. With two other major credit bureaus offering substantially similar services, the biggest question is whether customers will return to Equifax, and whether financial institutions will continue to send valuable customer data -- the lifeblood of the business -- to the company, given its recent security problems.
