FTC launches probe into Equifax over massive data breach
In an unusual move, the Federal Trade Commission confirmed on Thursday that it has launched an investigation into Equifax (EFX) over its massive data breach.
"The FTC typically does not comment on ongoing investigations," said Peter Kaplan, the FTC's Acting Director of Public Affairs, in a statement. "However, in light of the intense public interest and the potential impact of this matter, I can confirm that FTC staff is investigating the Equifax data breach."
The company, one of the nation's biggest credit bureaus, said on Sept. 7 that hackers gained access to personal information belonging to 143 million U.S. consumers after exploiting a vulnerability on the company's website. The theft, which occurred between mid-May and July, included people's names, Social Security numbers, birth dates and other data.
Equifax faces mounting public pressure to account for how hackers were able to penetrate its systems. The House Energy and Commerce Committee has summoned CEO Richard Smith CEO to testify at a hearing next month. Leaders of the powerful Senate Finance Committee have also written a letter to Smith seeking information on the hack, including when the company became aware of it.
The federal Consumer Financial Protection Bureau has announced its own investigation of Equifax, while at least 40 state attorneys general are also looking into the company.
Equifax this week attributed the data theft to an unsecured web server.
"We are actively engaging with and being responsive to regulators, federal agencies and legislators and expect to continue to do so in the future," an Equifax spokeswoman said.
The credit bureau has angered customers with its initial response to the breach, one of the largest in U.S. corporate history. An Equifax website intended to let people know if their personal data has been compromised has drawn complaints about its accuracy.
Consumer advocates also initially noted that the terms of use for a credit-monitoring service Equifax is offering free for one year required the victims to sign away their rights to sue the company. Equifax has since backed away from that requirement.
Compounding those frustrations, three senior executives with the company, including its chief financial officer, sold $1.8 million worth of company stock only days after Equifax discovered the breach but weeks before it was made public. More than three dozen senators from both parties have asked the FTC, Justice Department and Securities and Exchange Commission to examine possible insider trading in connection with the stock sales.
Equifax denies that the trades were connected to the cyberattack.
Financial analysts said Equifax must act quickly to head off potentially aggressive government action against the company.
"We believe that Equifax is running out of time to fully unveil a response to the data breach that will be extensive enough to win political praise and help the firm escape the spotlight," said Jaret Seiberg, an analyst with Cowen Washington Research Group, in a note.
The company's shares fell $3.05, or 3 percent, to $95.94, after news of the FTC probe surfaced before recovering later in the day.