Equifax to shell out $700m in fines over 2017 breach
Equifax will pay up to $700 million to victims, regulators and US authorities following its catastrophic 2017 data breach, US federal trade commission officials have announced.
The settlement is split between the US government and the approximately 145 million US residents who were victims of the breach. However, there are some conditions attached to the payout for victims.
The settlement obliges Equifax to contribute $300 million to a fund which will pay for credit monitoring services for affected US residents, and will also be used to reimburse victims for any identity theft protection they purchased, or other expenses incurred, as a result of the hack.
Equifax will supplement this fund with up to $125 million, depending on the amount of compensation required, and will also provide six free annual credit reports for the next seven years. It will also pay $100 million in civil penalties to the US Consumer Financial Protection Bureau, as well as $175 million to Puerto Rico, the District of Columbia and 48 US states.
The breach cost the company $1.4 billion, as of the company's latest financial results, a figure which, when combined with this latest round of penalties, rises to $2.1 billion. The Information Commissioner's Office has also previously hit Equifax with its maximum £500,000 fine over the 15 million UK residents who were affected by the breach.
This collection of financial reprimands, which represents the largest collection of fines and penalties in US data breach history, also comes with a scathing rebuke of Equifax's security practices. According to the FTC's complaint, "hackers were able to access a staggering amount of data because Equifax failed to implement basic security measures".
Its failure to segment its network, protect legacy databases or patch vulnerabilities in a timely manner (all while claiming to put reasonable safeguards in place) put Equifax in breach of the FTC Act and the Gramm-Leach-Bliley Act, the regulator said. Jun Ying, an ex-Equifax executive and the company's CIO at the time of the breach, was also sentenced to four months imprisonment for insider trading last month, after using his knowledge of the breach to dump his company shares before it was publicly announced.
On top of the requirements around penalties and compensation, the terms of Equifax's settlement also compel the company to institute sweeping changes of its security procedures. These include conducting annual security risk assessments, rolling out intrusion monitoring and patch management software, appointing a designated head of information security and making sure that any partners who access Equifax's stores of personal information also abide by similar security requirements. Its security program must also be assessed by an FTC-approved third party every two years.
"Companies that profit from personal information have an extra responsibility to protect and secure that data," FTC Chairman Joe Simons said as part of a statement. "Equifax failed to take basic steps that may have prevented the breach that affected approximately 147 million consumers."
"The incident at Equifax underscores the evolving cybersecurity threats confronting both private and government computer systems and actions they must take to shield the personal information of consumers," added Consumer Financial Protection Bureau Director Kathleen L. Kraninger. "Too much is at stake for the financial security of the American people to make these protections anything less than a top priority."
Industry: Cyber Security
- Outside IR35 Contract- SC / DV - Cloud / VMware Solution Architect
- Outside IR35
Solution Architect Contract - with active Security Clearance needed for Outside IR35 Contract London. SC / DV (must be willing to undergo DV) 6 month rolling Immediate Experience delivering technical Security Architecture design / assurance of security design. Specific experience with Cloud and VMWARE technologies Cross domain experience desirable HLD / LLD Current SC Clearance a must. London 3 days a week Immediately interviewing.
- Contract Night Shift Senior SOC Analyst | Microsoft Defender | Outside IR35
- United Kingdom
- Outside IR35
Contract Night Shift Senior SOC Analyst | Microsoft Defender / Sentinel | Outside IR35 Looking for an experienced SOC analyst to cover a night shift SOC operation. Level 2 technical Analyst. You must have current hands on technical experience with Microsoft defender / Sentinel within a customer facing SOC environment. This is a UK based position.
- DV Cleared CyberArk Consultant- Contract
- City of London
- Upto £700 per day
CyberArk Consultant is needed to be responsible for leading the deployment of CyberArk solutions for this Secure government site You will work with customer, helping to create CyberArk Strategic Roadmaps, on-boarding accounts, product and process integration into the CyberArk Solution and Proviso of Installation and technical Documentation. We are looking for this individual to have experience in: In CyberArk deployment, and ideally leady the deployment both strategically and also technically for this project we need the consultant to hold current DV cleared status For the right individual this could be a long term project.
- CyberSecurity Portfolio manager
- upto €60,000 plus benefits
A cybersecurity rockstar with a strategic mind and a passion for building winning solutions, is required to craft a cutting-edge security portfolio for an expanding IT Services business , with the aim to develop solution & services that will protect their customers business. this role will involve, develop & implement security strategies, manage the portfolio, drive sales, and collaborate with teams across the globe. we are looking for someone with experience in managing and building a cybersecurity portfolio of service a knack for building relationships & leading diverse teams Strategic vision & the ability to translate it into action strong communication & collaboration skills