By Lee Mathews
Equifax is one of the largest credit reporting agencies in America, which makes an announcement the company just issued particularly disconcerting. An authorized third party gained access to Equifax data on as many as 143 million Americans. That's nearly half the population of the United States as of the last census.
Equifax announced the incident this afternoon. According to the report, the breach was discovered on July 29th. The perpetrators gained access by "[exploiting] a [...] website application vulnerability" on one of the company's U.S.-based servers. The hackers were then able to retrieve "certain files."
Included among those files was a treasure trove of personal data: names, dates of birth, Social Security numbers, addresses. In some cases -- Equifax states around 209,000 -- the records also included actual credit card numbers. Documentation about disputed charges was also leaked. Those documents contained additional personal information on around 182,000 Americans.
Personal data like this is a major score for cybercriminals who will likely look to capitalize on it by launching targeted phishing campaigns. Noted security researcher Kenneth White believes that "Based on the disclosure, the impact of this could be as far-reaching as the OPM breach." The OPM -- Office of Personnel Management -- fell victim to a hack in June of 2015. Months later, ransomware criminals used the 22 million stolen email addresses to launch a large-scale attack.
White adds, "much attention will be focused on the findings of the forensics firm hired to investigate. One would hope that with such a sensitive workload as this, Equifax has strong auditing and logging controls in place. With any luck, those records will help investigators piece together a clearer picture of which data and networks were compromised, but this is an imprecise science."
For its part, Equifax disclosed the breach quickly and was quick to point out that its "core consumer and commercial credit reporting databases" were not accessed. Those whose credit card numbers and dispute data were accessed will be notified directly by mail. The company has created a dedicated website to educate those impacted about the risks, and a call center is open from 7am to 1am Eastern to answer questions. Equifax will also be providing free credit monitoring services for all those affected.