If the business people at Equifax didn't spend through the nose on security then they are negligent, quite probably criminally so. You can argue that Target is

If the business people at Equifax didn't spend through the nose on security then they are negligent, quite probably criminally so. You can argue that Target is not in the "we need to secure this treasure trove of data" business and so them leaking 40 million credit cards is just an unfortunate accident. But when you sit on the PII of 150 million people then you need to be top notch security wise. I am sure the eventually inevitable courts will appreciate a company culture where admin/admin is acceptable.