The massive cyber security breach unveiled by Equifax that saw the personal data of millions of people taken will mean some “very unfortunate” stories to come, says a Canadian technology executive.
Equifax revealed Thursday that the breach discovered on July 29 could expose the personal information of about 143 million people in the United States. The company also said that the information of an undisclosed number of people in Canada and the United Kingdom was compromised.
Thieves obtained consumers’ names, birth dates, addresses, social security numbers and, in some cases, driver’s licence numbers in the cyberattack on the credit monitoring company, which is based in Atlanta.
“So this means [the purpetrators] have a detailed financial history, obviously all of your current information, and a lot of your current debts, as well as, sort of, paying history,” Mark Nunnikhoven, vice-president of cloud research at Trend Micro, told CBC News.
He said the information obtained in the Equifax breach differs from cases involving the theft of credit card numbers because once the card is flagged, its number will be changed and the card will no longer be useful.
“But with the type of information that’s exposed in a breach like this, [the thieves] can start going out and getting new credit, getting new financial products under your identity and those have a much longer lifetime,” Nunnikhoven said.
“On a scale of one to 10, this is a 10 in terms of potential identity theft,” said Gartner security analyst Avivah Litan. “Credit bureaus keep so much data about us that affects almost everything we do.”
The breach at Equifax is far from the largest in history. That dubious distinction belong to Yahoo, which saw more than one billion user accounts compromised in two thefts. However, it could be the largest theft of U.S. social security numbers, topping a 2015 hack of health insurer Anthem Inc. that involved the data of about 80 million people.
On social media, several Canadian users expressed frustration with Equifax Canada, calling on the company to let them know how they can check if their personal information has been part of the security breach.
. @equifaxcanada should Canadians worry about the security breach – hack of Equifax in the US? Please reply. #equifaxhack #equifaxbreach
— @jaimehorwitz
@equifaxcanada It would be nice to know for sure if ALL my personal financial information is safe or not. As a courtesy, you know. #equifax
— @jayheidecker
Nunnikoven gave Equifax full credit for explaining the breach to the public, noting that the company has set up a dedicated website to keep consumers informed.
“Hopefully the impact to people will be minimal, but with the amount of of people affected, unfortunately we are going to see some very unfortunate stories coming out of this,” he said.
The process of recovering from the damage caused by identity theft can take weeks, months or even years, Nunnikoven said.
“When it comes to the type of information that Equifax had, as far as that deep history, all of that identity information, unfortunately the damage can be a lot harder to walk back,” he said.
At least two proposed federal class-action lawsuits have already been filed in the United States against Equifax, Reuters reported Friday.
One suit, which was filed in Atlanta, accused the firm of negligence and wilfully violating the Fair Credit Reporting Act for failing to protect customer information.
Stock drop
Investors punished the company’s stock on Friday morning. On the New York Stock Exchange, Equifax shares were down more than 14 per cent, tumbling $20.64 US to reach $122.08 US.
Equifax has said that three of its executives who sold stock just days after the company discovered the breach were not aware of the hack at the time.
Equifax chief financial officer John Gamble and two other executives, Rodolfo Ploder and Joseph Loughran, sold a combined $1.8 million US in stock on Aug. 1 and Aug. 2.
In a statement, the company said the executives “had no knowledge that an intrusion had occurred at the time they sold their shares.”