Equifax to shell out $700m in fines over 2017 breach

Equifax will pay up to $700 million to victims, regulators and US authorities following its catastrophic 2017 data breach, US federal trade commission officials have announced.
The settlement is split between the US government and the approximately 145 million US residents who were victims of the breach. However, there are some conditions attached to the payout for victims.
The settlement obliges Equifax to contribute $300 million to a fund which will pay for credit monitoring services for affected US residents, and will also be used to reimburse victims for any identity theft protection they purchased, or other expenses incurred, as a result of the hack.
Equifax will supplement this fund with up to $125 million, depending on the amount of compensation required, and will also provide six free annual credit reports for the next seven years. It will also pay $100 million in civil penalties to the US Consumer Financial Protection Bureau, as well as $175 million to Puerto Rico, the District of Columbia and 48 US states.
The breach cost the company $1.4 billion, as of the company's latest financial results, a figure which, when combined with this latest round of penalties, rises to $2.1 billion. The Information Commissioner's Office has also previously hit Equifax with its maximum £500,000 fine over the 15 million UK residents who were affected by the breach.
This collection of financial reprimands, which represents the largest collection of fines and penalties in US data breach history, also comes with a scathing rebuke of Equifax's security practices. According to the FTC's complaint, "hackers were able to access a staggering amount of data because Equifax failed to implement basic security measures".
Its failure to segment its network, protect legacy databases or patch vulnerabilities in a timely manner (all while claiming to put reasonable safeguards in place) put Equifax in breach of the FTC Act and the Gramm-Leach-Bliley Act, the regulator said. Jun Ying, an ex-Equifax executive and the company's CIO at the time of the breach, was also sentenced to four months imprisonment for insider trading last month, after using his knowledge of the breach to dump his company shares before it was publicly announced.
On top of the requirements around penalties and compensation, the terms of Equifax's settlement also compel the company to institute sweeping changes of its security procedures. These include conducting annual security risk assessments, rolling out intrusion monitoring and patch management software, appointing a designated head of information security and making sure that any partners who access Equifax's stores of personal information also abide by similar security requirements. Its security program must also be assessed by an FTC-approved third party every two years.
"Companies that profit from personal information have an extra responsibility to protect and secure that data," FTC Chairman Joe Simons said as part of a statement. "Equifax failed to take basic steps that may have prevented the breach that affected approximately 147 million consumers."
"The incident at Equifax underscores the evolving cybersecurity threats confronting both private and government computer systems and actions they must take to shield the personal information of consumers," added Consumer Financial Protection Bureau Director Kathleen L. Kraninger. "Too much is at stake for the financial security of the American people to make these protections anything less than a top priority."
source itpro
Industry: Cyber Security

Latest Jobs
-
- IAM Consultant- OKTA
- Germany
- upto €90,000 plus benefits
-
I am looking for an experienced IAM process Manager to help drive forward a series of IAM implementation for a global Manufacturing business, Ideally you will be skilled with Okta and have knowledge of PAM Solutions, You will be responsible for: Driving the design and continuous improvement of complex IAM solutions in close collaboration with business partners Consult on the optimisation of IAM processes and design proper IT-based solutions to meet availability and quality targets Define technical specifications for SW-development (standards, design patterns, test cases, scenarios) and manage the life cycle of designed solutions Actively scan for relevant innovations and new technologies to identify further potential for improving IAM solutions and processes using OKTA Analyse new features of the regular Okta releases We are looking for someone with strong IAM experience as an Architect, Analyst, Technical Engineer, or similar role in the Identity and Security domain Experience with relevant certifications in development/administration, design and configuration of the Okta IAM platforms Familiar with LCM - joiners, movers, leavers, application federation - SAML, OIDC, SCIM and many other IAM terms Good mix of competences in IAM business process and project management concepts and tools e.g., ServiceNow, Jira, PRINCE2, SCRUM (agile)
-
- SAP Security Consultant
- France
- upto €70,000 plus benefits
-
I am looking for an experienced SAP Security Consultant. The ideal candidate will have a strong understanding of SAP security concepts and be able to apply them to real-world scenarios. ideally you will also have experience with Securitybridge or Onapsis, or a similar SAP security tool. Your responsibilities will include: Reviewing and auditing SAP security settings and controls Identifying and remediating security vulnerabilities Implementing security best practices Educating users on SAP security Experience experience in SAP security Experience with Securitybridge or Onapsis, or a similar SAP security tool would be very advantageous Strong understanding of SAP security concepts Excellent problem-solving and analytical skills Excellent communication and presentation skills Fluent in French & English
-
- Post Grad MSc Cyber security - Junior Cyber Risk Analyst wanted. UK
- United Kingdom
- Entry role
-
The perfect start to your new Cyber Security Career. Post Graduate Cyber Risk Analyst Wanted. Are you are fresh from earning your Cyber Security MSc and eager to start your career in Cyber Security? We are looking for a recent post graduate to join a forward thinking Cyber Security Consultancy for the ideal entry role into Cyber Security. Whilst employed industry experience is not expected, as full training and support will be provided, a history of recent education in Cyber Security / Cyber Risk is essential. We are looking for someone with an inquisitive mind, who is confident to ask the right questions and who isn't afraid to challenge the status quo. Superb communication skills are a must (in person, written and verbal) This is a UK based role that is remote first with monthly travel (1-2 a month) to meet with the team and in time to meet clients. If you aren’t available to travel this isn’t the opportunity. We are unable to provide VISA sponsorship as there will be a requirement to achieve Security clearance If you're adaptable, open to fresh perspectives, and excited to be part of a forward-thinking team and looking for an opportunity to help make a difference in a Cyber consulting role, this opportunity is for you. For more information apply here……
-
- Microsoft Exchange Contractor | London | OUTSIDE IR35 | SC Cleared
- London
- OUTSIDE IR35
-
Microsoft Exchange Contractor | London | OUTSIDE IR35 | SC Cleared • We require someone that has experience of migration exchange from windows server 2012 to 2019. • In depth understand of On-Prem exchange server management and deployment. • Experience migrating On-Prem exchange servers from 2012 upwards. • Secure Email Gateway experience essential Due to the nature of the requirement the individual must be commutable to London 2-3 days a week.