He pressed Smith on the issue of human error and double-checking of systems and software. 'I don't think we can pass a law that, excuse me for saying this, fixes stupid,' said Walden. Greg Walden (R-Ore.), Smith explains that there was a protocol in place to fix the software flaw that led to Equifax being breached. 17 that 'the picture developed' and the company realized what they'd been calling an 'incident' was actually a hack.ġ0:50 a.m. Latta countered, 'Your company is built on data-did you think to ask if any personal data had been stolen?' Smith said it was a 'cumbersome, cumbersome process' to figure out how a breach occurred or where it came from. Latta pushed Smith on when he found out that personal data had been compromised, but Smith declined to give a timeline. Smith concluded by saying, 'I believe we need a public-private partnership to evaluate how best to protect Americans' data going forward.' His written testimony mentioned replacing Social Security numbers, which currently function as Americans' primary form of identification for financial and other sensitive transactions. But it wasn't until late August that Equifax concluded they had experienced a major breach, Smith said. Smith was notified on July 31, and called in a cybersecurity law team on Aug. According to the timeline he laid out, the company noticed 'suspicious activity' July 29 in a consumer dispute portal. The hack occurred around May 13, Smith said. 'To each and every person affected by this breach, I am deeply, deeply sorry that this occurred.'

'As CEO I was ultimately responsible for what happened on my watch,' he said. Former CEO Rick Smith, who stepped down last week but is still an adviser to Equifax, began by summarizing his written testimony.

'The problem is that there aren't any laws and regulations forcing companies to provide a certain level of cybersecurity,' Jeff Williams, CTO and co-founder of Contrast Security, told CBS MoneyWatch in an email.ġ0:15 a.m. Under current law, it's unlikely that Equifax would face criminal liability, tech experts say. This isn't the case with credit reporting. In other data breaches, like one at Target or Michael's, consumers could choose not to shop at a store that was affected. Frank Pallone (D-N.J.), the ranking member, brings up a point several made: consumers don't have a choice in whether credit bureaus collect their data. 'It's like the guards at Fort Knox forgot to lock the doors and failed to notice that thieves had broken in.' She called out a bill she introduced that would require prompt notification of a breach, among other things.Ĭommittee Chair Greg Walden (R-Ore.) described the incident this way: 'Because consumers don't have a choice, we can't expect credit reporting agencies to self-regulate,' she said. Consumers don't have a choice of what information Equifax, or for that matter, TransUnion or Experian, collects,' she said. 'We have these under-regulated private data collecting detailed information about American consumers.

Ranking member Janice Schakowsky (D-Ill.) was more fiery, calling the breach 'predictable but not inevitable.' Bob Latta (R-Ohio), who chairs the subcommittee on digital commerce and consumer protection, set out the basic lines of the committee's questioning in his opening statement Tuesday: how did the breach happen, what policies were in place to prevent it, and were they followed?

But even though Equifax's policy required the upgrade to occur within 48 hours, Smith said that did not happen. The company emailed out that warning the following day and requested that applicable personnel install the upgrade. On March 8, Smith said, the Department of Homeland Security warned the company it needed to patch a particular vulnerability in software used by Equifax and other businesses. In his prepared testimony, he blamed the flaw on a combination of human error and technological failures. Richard Smith is expected to lay out in detail how the breach happened. Its initial response, for which it was heavily criticized, was to offer one year's worth of credit monitoring and require customers who signed up for the service to waive their right to sue the company. It's taken the company a while to get to this point. To people affected by the breach, Equifax is offering free credit monitoring across all three credit bureaus, credit locks and insurance for costs linked to identity theft.

Chatbot website for suing equifax