Equifax website sent users to false URL

WASHINGTON — Equifax Inc. took part of its website offline Thursday after code on the site redirected users to a malicious URL urging them to download malware.

Also Thursday, a top Republican congressman introduced a bill that would stop credit reporting companies such as Equifax from using Social Security numbers to verify Americans’ identities.

The moves come a month after Equifax revealed that a data breach exposed the Social Security numbers and birthdates of as many as 145.5 million Americans. That hack took place after Equifax failed for several months to fix a software flaw that federal officials had warned about in March.

Late Wednesday night, independent security analyst Randy Abrams said in a blog post that while he was trying to download his credit report from the Equifax site, he clicked a link that kicked him to a third-party website with “one of the ubiquitous fake Flash Player Update screens.” His post was first reported by technology news site Ars Technica.

Equifax said Thursday afternoon that the problem stemmed from code provided by a third party.

“The issue involves a thirdparty vendor that Equifax uses to collect website performance data, and that vendor’s code running on an Equifax website was serving malicious content,” the company said in a statement. “Since we learned of the issue, the vendor’s code was removed from the webpage and we have taken the webpage offline to conduct further analysis.”

Equifax emphasized that its “systems were not compromised” and said that despite early reports, the problem “did not affect our consumer online dispute portal.”

Its spokespeople did not answer questions about when the company learned of the problem or how many website visitors clicked the link.