Former Equifax CEO apologizes for massive data breach

The former chairman and CEO of Equifax says the company was entrusted with personal information of 140 million Americans and “we let them down” as human error and technology failures allowed a massive data breach.

In prepared congressional testimony, Richard F. Smith said the millions are not just numbers in a database, but friends, family, neighbors and members of his church. The revelation last month of the disastrous hack to Equifax's computer system rocked the company which faces several state and federal inquiries and a myriad of class-action lawsuits.

“To each and every person affected by this breach, I am deeply sorry that this occurred. Whether your personal identifying information was compromised, or you have had to deal with the uncertainty of determining whether or not your personal data may have been compromised, I sincerely apologize,” Smith said. “The company failed to prevent sensitive information from falling into the hands of wrongdoers.”

Smith, who resigned after overseeing the company for a dozen years, says Equifax was hacked by a yet-unknown entity. He said the information stolen included names, Social Security numbers, birth dates and addresses. In addition, the credit card information for about 209,000 consumers was also stolen as well as certain documents with personally identifying information for approximately 182,000 consumers.

Lawmakers are expected to question Smith on how the company allowed the breach to occur, why it took as long as it did to notify consumers and what's it's doing to help consumers protect themselves going forward. The House subcommittee holding the hearing has jurisdiction over e-commerce and consumer protection issues.

Smith said the Department of Homeland Security warned the company on March 8 about the need to patch a particular vulnerability in software used by Equifax and other business. The company disseminated that warning by email the next day and requested that applicable personnel install the upgrade. The company's policy requires the upgrade to occur within 48 hours, but Smith said that did not occur. The company's information security department also ran scans on March 15 that did not pick up the vulnerability.

“I understand that Equifax's investigation into these issues is ongoing,” Smith said in the prepared remarks. “The company knows, however, that it was this unpatched vulnerability that allowed hackers to access personal identifying information.”

Smith said it appears the first date the hackers accessed sensitive information was May 13. Between May 13 and July 30, there is evidence to suggest the attackers continued to access sensitive information, but it wasn't until July 29 that Equifax's security department observed suspicious network traffic. Smith said the hack was over the next day, but the hard work of figure out the impact was just beginning.

Smith said he was told of the suspicious activity on July 31 in a conversation with the company's chief information officer.

The former chairman and CEO of Equifax, Richard Smith, says the company was entrusted with personal information of 140 million Americans and “we let them down” as human error and technology failures allowed a massive data breach.