Equifax is in the business of selling this information to other companies. They are offering services, which allow banks and other institutions to check this in

Equifax is in the business of selling this information to other companies. They are offering services, which allow banks and other institutions to check this information through web service interfaces. It is kind of a core functionality that this information is available through a web server. More old fashioned way would have been to expose this information through some obscure protocol, but I don't think that would make it any more secure. Now a different thing is that should this information be available through a server that is accessible directly through the Internet (and I don't know if it was) or if they should require for example a dedicated VPN connection.