Equifax Failed on Multiple Fronts in 2017 Data Breach, GAO Says

Equifax failed on multiple fronts in 2017, when hackers exploited data of more than 145.5 million Americans (see 1805080045), GAO reported Friday. That included failures with identification, detection, segmentation and data governance. The IRS, Social Security Administration and U.S. Postal Service “identified a number of lower-level technical concerns that Equifax was directed to address,” it said. Sen. Elizabeth Warren, D-Mass., and Rep. Elijah Cummings, D-Md., who sought the report, cited the findings as evidence Congress should pass the Data Breach Prevention and Compensation Act. Equifax would have been penalized at least $1.5 billion under the law. Citing similar remarks in the report, an Equifax spokesman emailed that the company has “taken significant steps to strengthen data security protocols and controls, evaluate and adjust data governance processes and adjust our organizational structure to enhance management of cybersecurity risk.”