Expert: Equifax website raises security concerns


NEW YORK (AP) Developments on Friday, Sept. 8, about a massive breach at credit monitoring company Equifax (all times Eastern Daylight Time).

  • 2:15 p.m.

A security expert said a website created by credit monitoring company Equifax to help its customers find out if their personal information was stolen after a massive data breach raised its own security questions.

Georgia Weidman, the founder and chief technology officer for security firm Shevirah, said the website Equifax created looked like the kind of website set up by attackers to trick people into disclosing information.

Weidman said it was teaching people “entirely the wrong things about using the internet securely.”

Weidman said she was troubled by Equifax’s approach to security generally, including reports that it didn’t respond to basic scripting bugs it was warned about last year.

The website is , Equifax said consumers could call 866.447.7559 for more information about the breach.

  • 2:00 p.m.

Washington regulators and politicians swiftly criticized Equifax over the exposure of 143 million Americans’ personal information.

Rep. Jeb Hensarling, R-Texas, chairs the House Financial Services Committee. He said he will call for Congressional hearings on the breach.

Equifax’s requirement for affected customers to sign up for arbitration also drew a backlash. Democrats in the House and Senate called on the company to pull back on its requirement that anyone who signs up for credit monitoring give up their right to sue Equifax in a class-action lawsuit.

The Consumer Financial Protection Bureau, the nation’s chief watchdog for financial services, called the breach “troubling” and said Equifax should drop the arbitration requirement. The CFPB recently passed a rule requiring financial companies to let customers sue together when a large group had been wronged.

  • 12:00 p.m.

There’s no way around it: The news from credit reporting company Equifax that 143 million Americans had their information exposed is very serious.

The crucial pieces of personal information that criminals may need to commit identity theft Social Security numbers, birthdates, address histories, legal names — were all obtained.

For consumers, it may be time to take even more extreme measures to lock down their information, outside of routine advice like checking your credit reports regularly and seeing if there are any abnormal transactions on your accounts.

The strongest possible option a person can take immediately is placing what’s known as a credit freeze on their credit files with the major credit bureaus. That makes it impossible to open new accounts and bank cards for thieves as well as yourself.

  • 11:40 a.m.

Investors were bailing out on Equifax a day after the credit monitoring company said a data breach exposed the Social Security numbers and other personal data of 143 million Americans.

Equifax shares fell about 13 percent to $123.75 in heavy trading. The decline equated to about $2.28 billion in lost market value.

The company is one of three major U.S. credit bureaus and the declines extended to its competitors. TransUnion fell 4 percent and Experian stock declined 1 percent in London.

Lenders rely on the information collected by the credit bureaus to help them decide whether to approve financing for homes, cars, and credit cards. Credit checks are even sometimes done by employers when deciding whom to hire for a job.

  • 12:00 a.m.

Credit monitoring company Equifax was hit by a high-tech heist that leaves unwitting victims having to worry about the threat of their identities being stolen.

The Atlanta-based company, one of three major U.S. credit bureaus, said “criminals” exploited a U.S. website application to access files between mid-May and July of this year.

The theft obtained consumers’ names, Social Security numbers, birth dates, addresses and, in some cases, driver license numbers. The purloined data can be enough for crooks to hijack the identities of people whose credentials were stolen.

Equifax discovered the hack July 29, but waited until Thursday to let consumers know about it. The Atlanta-based company declined to comment beyond its published statement.