Equifax's entire job is maintaining highly sensitive financial information. That's their reason for existence, that's how they make money. Following a sort of,

Equifax's entire job is maintaining highly sensitive financial information. That's their reason for existence, that's how they make money. Following a sort of, I don't know, stackoverflow level of quasi "good enough" practices might be fine for J. Average Corporation but it isn't fine for a company like Equifax. The question on the table is whether or not Equifax could have prevented the data breach with the application of up to, oh, let's say a few tens of millions of dollars in resources (personnel, equipment, what-have-you) and merely applying common sense and industry accepted best practices. The answer seems to be: unquestionably yes. At least for this breach. And so, because that amount of money is much less than even their annual profits, Equifax has unquestionably acted negligently in that they had both the resources and the obligation to prevent the breach, but did not. There's no excuse for that.