Ex-Equifax CEO Richard Smith "deeply sorry" for data breach

WASHINGTON - The former chairman and CEO of Equifax (EFX) said the company was entrusted with personal information of 140 million Americans and "we let them down" as human error and technology failures allowed a massive data breach.

In prepared congressional testimony, Richard F. Smith said the millions are not just numbers in a database, but friends, family, neighbors and members of his church. The revelation last month of the disastrous hack to Equifax's computer system rocked the company which faces several state and federal inquiries and a myriad of class-action lawsuits.

"To each and every person affected by this breach, I am deeply sorry that this occurred. Whether your personal identifying information was compromised, or you have had to deal with the uncertainty of determining whether or not your personal data may have been compromised, I sincerely apologize," Smith said. "The company failed to prevent sensitive information from falling into the hands of wrongdoers."

Smith, who resigned last week after overseeing the company for a dozen years but who remains an adviser to Equifax, said the credit bureau was hacked by a yet-unknown entity. He said the information stolen included names, Social Security numbers, birth dates and addresses. In addition, the credit card information for about 209,000 consumers was also stolen as well as certain documents with personally identifying information for approximately 182,000 consumers.

Lawmakers are expected to question Smith on how the company allowed the breach to occur, why it took as long as it did to notify consumers and what's it's doing to help consumers protect themselves going forward. The House subcommittee holding the hearing has jurisdiction over e-commerce and consumer protection issues.

Smith is also scheduled to appear on Wednesday before the Senate Banking Committee and Thursday before the House Financial Services Committee.

"This is not going away this week no matter how well Rick Smith performs before Congress," Cowen & Co. analyst Jaret Seiberg said in a note. "That said, this will get much less attention and will fade far more quickly if Smith does well in answering questions and pushing the broader idea that consumers should be able to freeze their credit or some other macro issue that puts attention on the industry rather than on Equifax."

Smith said the Department of Homeland Security warned the company on March 8 about the need to patch a particular vulnerability in software used by Equifax and other business. The company disseminated that warning by email the next day and requested that applicable personnel install the upgrade. The company's policy requires the upgrade to occur within 48 hours, but Smith said that did not occur. The company's information security department also ran scans on March 15 that did not pick up the vulnerability.

"I understand that Equifax's investigation into these issues is ongoing," Smith said in his statement. "The company knows, however, that it was this unpatched vulnerability that allowed hackers to access personal identifying information."

Smith said it appears the first date the hackers accessed sensitive information was May 13. Between May 13 and July 30, there is evidence to suggest the attackers continued to access sensitive information, but it wasn't until July 29 that Equifax's security department observed suspicious network traffic. Smith said the hack was over the next day, but the hard work of figure out the impact was just beginning.

Smith said he was told of the suspicious activity on July 31 in a conversation with the company's chief information officer. He then provided a timeline of events that included a senior leadership team meeting on August 17 where he learned the forensic investigation has determined large volumes of consumer data had been compromised. He said the lead member of the company's board of directors was notified on August 22 and the full board two days later. He convened a board meeting to discuss the scale of the breach on Sept. 1.

Meanwhile, the company worked on a support package for consumers and then notified the public on Sept. 7.

Smith also said he was disappointed in the rollout of call centers and a website designed to help the people affected by the breach. He said the company has increased its number of customer service representatives and the website has been improved.

"Still, the rollout of these resources should have been far better, and I regret that the response exacerbated rather than alleviated matters for so many," Smith said in the prepared testimony.

Equifax has recently sought to allay public anger about its response to the hack by introducing a new service that lets consumers lock and unlock their credit reports for life free of charge.

Smith's successor as CEO, Paulino do Rego Barros Jr., acknowledged in a Sept. 27 op-ed piece in The Wall Street Journal, that it has failed to offer sufficient support for consumers who may be affected by the breach.