27 ms·
Equifax C.E.O. Richard Smith Retires After Huge Data Breach
- politician 9y agoDoes he get to avoid testifying before Congress by resigning?
- Overtonwindow 9y agoThey're all jumping ship now. I hope congress, or the FBI, hold some of these people responsible for the mess they've created, and take Equifax to the woodshed.
- _Codemonkeyism 9y ago"or the FBI, hold some of these people responsible" Hopefully, this then will create a different culture in other companies. Things did change after Enron (though SOX is such a pain).
- Overtonwindow 9y agoI'm pessimistic we'll see anything even close to Enron. When the big banks collapsed, none of the executives went to jail. I doubt we'll see that here, but it would send a powerful message if the inept VP of IT at Equifax was paraded in front of the cameras in handcuffs, and the CEO held personally responsible. There's a corporate shell enjoyed by major American companies. At this point I wonder: What would have to happen for the CEO of a major company to go to jail?
- KGIII 9y agoWe must first establish what laws we believe we they have broken and that are likely to be provable beyond reasonable doubt in court. I'd rather due process than revenge without due process.
- avs733 9y agoI'd rather they be treated as many American's are when they have their first encounter with police who believe they committed a crime...that is rarely aligned with a presumption of innocence. You aren't wrong in a theoretical sense, but I am all for equality before the law as a precursor to due process. Due process without equitable treatment means very little except to those at the top.
- Spivak 9y agoSo you would rather people be treated shitty like everyone else than treat everyone else better?
- lurker456 9y agoSelective enforcement of a shitty law is arguably worse for society then across the bar even enforcement of that law. In the latter case, there are less groups that will prevent change.
- avs733 9y agono...I very intentionally did not say that. I said that until everyone is treated with some reasonable equity the distinction between shitty and better is academic because the better never trickles down.
- maxerickson 9y agoNew regulation can impact them significantly without violating due process. Just deciding that they aren't operating in the public interest and revoking their charters probably wouldn't violate due process. Not in fashion though.
- howard941 9y agoThe reasonable doubt burden is high but don't worry about the company, we don't even get there when there isn't any criminal liability for what looks like the reckless disclosure of vast quantities of private info.
- rothbardrand 9y agoThis is not enough. We need a reform to legislation to make these companies liable both for data breaches and for false information. Too often the CRAs are used effectively as extortion mechanisms whereby your credit rating his held hostage to extract money you don't owe for collection agencies.
- Multicomp 9y agoHmmm let me get this straight: 143,000,000+ people have to pay Equifax $3-20+ to get their credit frozen, and you get to just walk away and retire with oodles of money from your illicit stock selling and severance packages? There is no justice sometimes. That's around ~430,000,000 USD for Equifax alone [edit: if] 143M people got their credit frozen at $3 per freeze. (Obviously back of napkin math, and not everybody pays the same or even freezes their credit)
- sb8244 9y agoEquifax itself isn't charging for freezes right now. edit: ceejayoz has pointed out that they are free for 30 days only (and we're in that time window already).
- Multicomp 9y agoReally? Thanks for letting me know. I'll have to call and confirm the refund.
- ceejayoz 9y agoSure, but they're free for only 30 days. You still need to freeze with the other two agencies, and in a few weeks it'll cost money to lift your Equifax freeze if you want to open a new account.
- apetresc 9y agoI've been told by multiple sources that freezing with one agency is enough - other agencies automatically pick up that freeze.
- ceejayoz 9y agoNo, that's the 90 day fraud report. https://www.consumer.ftc.gov/articles/0497-credit-freeze-faqs https://www.consumer.ftc.gov/articles/0497-credit-freeze-faq... > How do I place a freeze on my credit reports? Contact each of the nationwide credit reporting companies. https://www.consumer.ftc.gov/articles/0275-place-fraud-alert https://www.consumer.ftc.gov/articles/0275-place-fraud-alert > Ask 1 of the 3 credit reporting companies to put a fraud alert on your credit report. They must tell the other 2 companies. http://money.cnn.com/2017/09/12/pf/what-is-a-credit-freeze/index.html http://money.cnn.com/2017/09/12/pf/what-is-a-credit-freeze/i... > In response to public outcry, Equifax announced that fees to freeze your credit will be waived for the next 30 days. But even that doesn't totally protect your information since your data isn't fully frozen until it is on ice at all three credit bureaus. The other bureaus have their own fees. It's also unclear whether Equifax would still charge you a fee to lift the freeze. The company did not immediately respond to request for comment.
- katastic 9y agoI wish I could "retire" after selling out over half of the workers in the USA.
- busterarm 9y agoActually, if you want to limit it to workers, it's around 95%, based on our last good data on this.
- FussyZeus 9y ago> Speaking for everyone on the Board, I sincerely apologize. We have formed a Special Committee of the Board to focus on the issues arising from the incident and to ensure that all appropriate actions are taken.” > Now if you'll excuse me, this golden parachute isn't going to pull it's own rip cord. Have fun fixing all your credit reports and enjoy Equifax's "free" data protection services, your contributions and patience (or short attention span, whichever you prefer) will be thoroughly appreciated by my successor, until he too fails too hard and has to endure a life of permanent financial security and nonstop leisure.
- WillReplyfFood 9y agoI take full responsibility for those breaches, and thus decided to step back, and for the remainder of my life work in customer support of a banke to fix those whose accounts are targeted. No CEO ever Aye, the noble folks must upheld to diffent standards. Onwards, to bigger and better things they grow- they are a diffrent people, not bound to clean up after themselves. All that outdated respons-hillbillity just holds the innovation of scams back.
- UnoriginalGuy 9y agoIf I drive my vehicle recklessly, even if nobody is injured (or no property), I can receive a citation, risk having my license revoked, and risk being arrested. Why is it that American corporations and their leadership have less oversight than your average 15 year old driver? They keep reminding us of corporate personhood when it is convenient, but where is the personhood responsibility? Companies aren't going to spend money on security until the potential costs impact them rather than others (in this case all of us). That's something that urgently needs to change. As you can see by Equifax's stock, nobody in the stock market thinks that the governments are going to punish or collapse Equifax, and the worst part is that they're likely right (see BP for example). This too big to fail, too big to jail, too big to punish thing is really starting to get on my nerves. Even if we aren't ready to send corporate executives to prison, let's at least fine Equifax so much they go out of business, and it sends a shot across every other business's bow about what will happen if they mishandle sensitive information.
- adekok 9y agoTheir security head was a music major, with little or no experience in the field. https://www.nbcnews.com/business/consumer/equifax-executives-step-down-scrutiny-intensifies-credit-bureaus-n801706 https://www.nbcnews.com/business/consumer/equifax-executives...
- ceejayoz 9y agoMany of us don't have formal credentials in computer science or security. There are plenty of reasons to go after Equifax, but someone's college major from decades ago isn't one of them. https://www.washingtonpost.com/news/the-switch/wp/2017/09/19/equifaxs-top-security-exec-made-some-big-mistakes-studying-music-wasnt-one-of-them/ https://www.washingtonpost.com/news/the-switch/wp/2017/09/19...
- v64 9y agoI agree that having an unrelated background doesn't entirely disqualify a person from a position, but when the consequences of failure are high and more money is at stake, then selection should be much more stringent. She probably would be a great fit for that position at 99% of the companies in the country, but with Equifax's position and data, someone with a more extensive background in security would be preferable.
- ceejayoz 9y agoMy understanding is her past roles included security work at HP, First Data, and Sun Trust. Equifax doesn't appear to have wandered into an orchestra practice and said "anyone wanna help run security?" Yeah, she fucked up. No, it wasn't because of her college major.
- FilterSweep 9y agoI don't think it was the college major, true, but it appears she enjoyed a large scale of "falling up" into that position that most people in our industry aren't afforded.
- cletus 9y agoSo if I design a car with a faulty steering mechanism that fails under unusual circumstances but, when it does, can cause a possibly fatal accident, I have a huge liability problem. Product liability as a whole is a pretty big deal. And that can be in spite of countless hours of testing where there is no evidence of malfeasance, negligence or even incompetence. Why haven't product liability laws caught up with information services? The Equifax breach here was caused by, at the very least, reckless negligence in that they failed to patch a published vulnerability for MONTHS after it was disclosed. Now I'm not talking about the BS class actions you get where the class gets nothing (except for the named plaintiffs who, for some reason, make out like bandits) and the lawyers make a ton of money. What I'm talking about is having the same expectations, requirements and civil and criminal punishments that product liability would have with a physical product, at least when it comes to willful negligence of this sort. The VW emissions scandal (rightly) is resulting in criminal prosecutions for fraud. But the makers of routers, IoT light bulbs and the like seem to suffer no consequences for (and thus have no incentive to improve) the security of their products. I just don't get it.
- deleted 9y ago[deleted]
- zitterbewegung 9y agoThis is because laws are slower to make than technology in general. Since the other laws were made with blood or money I would assume the same holds now. Once we have enough of these data breaches where people are fed up with it the laws will follow.
- kevin_thibedeau 9y agoComputerized consumer data warehousing has been going on for 50 years now. In that time span we've gotten all sorts of mandated safety and emissions features on cars.
- blowski 9y agoIf we start screaming "something must be done!", we'll be very unhappy with what actually gets done. There are so many people who are at least partly to blame when something like this happens. Bob the engineering manager who committed a quick but insecure fix years ago, Shirley the intern who didn't know what she was doing, Joe the manager who hired Bob and Shirley in the first place, Mike the manager at the company supplying third party software that ends up being exploited, etc. The worst outcome is that companies outsource all their IT security and therefore responsibility to companies that disappear as soon as there is a problem. But if we rush too quickly to impose criminal sanctions, that will be the likely outcome. The better solution is to work this one out as a society. Stop relying on things like SSNs and maiden name as "security", and stop building enormous silos of unnecessary data.
- genzoman 9y agoAnyone else think how convenient it was that no news agency broke this news prior to the Friday before September 11th? News cycle dies on the weekend, and on Monday you have the anniversary of the deadliest attack in 70 years on US soil. No political figure has talked about making these companies disclose this information as soon as possible, and no political figure is furthering any type of bill to make it illegal to know about a data breach and not tell anyone for months. American obsession and addiction to media is what caused Trump to win, and it's why egregious failures of trust such as this will continue to go relatively unpunished. We are constantly pumping out the equivalent of crude oil into your culture at the rate of millions of gallons a second. It's all trash, and it pollutes discussion and any sort of cooperation. Left/Right is the new religious battle, and the new holy books are blogs and twitter feeds. The media is under no obligation to tell you the truth, and in this case the lie is omission.
- pfarnsworth 9y agoRetirement isn't good enough, he should have his money clawed back. It's unfair that he gets to walk away scot free when hundreds of millions of people are fucked.
- whataretensors 9y agoLet him retire in prison with the rest of the C-levels.
- bedhead 9y agoEquifax has existed since 1899. It's in an oligopoly business that is completely unassailable, for better or worse. It would be fine with or without Richard Smith, who has been CEO for the last 11 years. He will have made something like a minimum of ~$145 million over that time. (If you factor in the value of his options since the grants it's more like $300 million) It's unconscionable. Entrepreneurial reward for managerial duty. People give hedge fund managers a hard time but at least those guys founded their companies and built them up...it's these hired-hand CEO's that are the real problem.
- quickpost 9y ago> Entrepreneurial reward for managerial duty. That is such a perfect way to sum up the pay disparities in large corporations these days. I have no problem whatsoever with someone making $300MM from the sale of the business they created, but making the same amount for manning a desk? Seems like madness.
- ScottBev 9y agoDepends on what they accomplish during their tenure. I've seen non-founder CEOs take a $100M business to $4B, and others take a $4B to $500M. $100M to $4B deserves the reward.
- bedhead 9y agoThere are exceptions, but even then they're not only few and far between, but also occupy a vague area where it's all one big counterfactual argument about whether someone else could've done the same thing and whether the die was largely cast anyway.
- freehunter 9y agoThat's where stock instead of cash makes sense. If you are solely responsible for the direction of the company and overseeing the execution of that direction like a c-level executive, you should get paid in stock. If you do your job right, your stock value goes up and you become richer as a reward for doing a good job. If you do poorly, you lose money as a punishment. If a CEO is making $100m per year in cash, there is no incentive to do a good job. Especially if they do so poorly they get fired, which means they get a $500m bonus as a reward for being fired.
- FilterSweep 9y agoMay he land gracefully from a proper golden parachute deployment
- ibejoeb 9y ago"Pack it up boys, our work here is done."
- bogomipz 9y ago>"The chairman and chief executive of Equifax, Richard F. Smith, retired on Tuesday ..." >"“Speaking for everyone on the board, I sincerely apologize,” Mark Feidler, the Equifax board’s new chairman" Where is the apology from the CEO?
- technofiend 9y agoHe's sorry he couldn't make it to the conference and apologize but the only flights to Gstaad left this morning and what's the point of renting a ski chalet if you're not going to stay there?
- bogomipz 9y agoYeah, if you listen closely you can hear the sound of golden parachute opening.
- FireBeyond 9y agoHe was unable to make a statement from his private jet en route to Europe...
- jstarfish 9y agoHe already apologized in the early days of the incident. At this point, after getting notified that he was canned, I doubt he gives a damn enough to comment further.
- wnevets 9y agoSo he gets to retire with a golden parachute made with diamonds, how nice.
- walshemj 9y agoInteresting that all the senior Equifax who have left have "retired" and not resigned ;-) Resigning is a known way of avoiding more serious penalties and loss of pension etc a lot of UK Police when facing serious charges suddenly resign due to stress. Its telling that when found guilty or far less serious offences the CEO of shell resigned giving up a lot of !$
- yarsk 9y agoWell that is a nice idea for him, retirement in a necessary when your age is up to it.
- yarsk 9y agoWell is a good idea to retire when your age and energy is exulted.
- la6470 9y agoThey should give free lifetime LIFETIME credit monitoring to all those are affected and not just 18 months worth of service .
- FilterSweep 9y agoIs there a way to tell if you are impacted without having to enter your SSN on suspicious websites? Its scary how little information the media is providing on this. Equifax does not provide an FAQ over what conditions you may be affected. I don't have a line of credit, and I have never used their services personally, HOWEVER, if a prior employer used them through a background check, or if they used a 3rd party who sends my data to equifax without me knowing, I'm pwned and didn't even know it.
- tyingq 9y agoThey say that overall, 143 million people were affected. There are about 250 million adults in the US. I would take that to mean that if you're a US adult, with any sort of credit history, you're affected. The affected data for the larger 143 million was: "Most of the consumer information accessed includes names, Social Security numbers, birth dates, addresses, and in some instances, driver’s license numbers." There's also a smaller set that had even more data exposed: "In addition, credit card numbers for approximately 209,000 consumers and certain dispute documents, which included personal identifying information, for approximately 182,000 consumers were accessed."
- stordoff 9y agoAre the affected people limited to the US? I know Equifax exists as a brand elsewhere, but I'm not sure how they are structured/which parts of the business the breach affected.
- tchadwick 9y agoI've heard Canada was affected as well. As a Canadian living in the US, I'm doubly fucked.
- FilterSweep 9y agoI don't have a "credit history" as I've never established a line of credit. However Equifax offers other services such as Background Checks which more americans are passing off their SSN to, generally unintentionally (its mandatory for work). This leads me to believe even young people are affected if theyve taken an internship or anywhere (AT ALL) that uses Equifax.
- CodeSheikh 9y agoHe is conveniently retiring to cash in severance packages and bonuses. He should be fired and brought in front of a judicial committee to answer questions for risking identity info of millions of consumers.
- rdiddly 9y agoRetirement is a bad word choice. In this case maybe it's better to blur the subtle distinction between retiring and resigning. At least appear contrite.
- la6470 9y agoPlease sign this petition https://petitions.whitehouse.gov/petition/equifax-should-provide-free-lifetime-credit-monitoring-service-affected-individuals-2017-data-breach-incident https://petitions.whitehouse.gov/petition/equifax-should-pro...
- wehadfun 9y agoHow does everyone feel about Susan Mauldin(Equifax Chief Security Officer) having a music degree?
- ridgeguy 9y agoI don't see her music degree as an indicator of her (in)competence to do the job. Anecdata example: my PhD is in neurobiology. Some of my engineering has been orbiting Mars since 1976. No neurons involved, just aerospace engineering. The breach that occurred on her watch is definitive of her incompetence. Nothing to do with her degree.
- raesene6 9y agoon it's own it doesn't mean anything either in favour or against her. Lots of more experienced IT Security people don't have appropriate degrees, generally as they didn't exist when those people got into the profession. As a personal data point, I've been in IT Security for 17 years, my degree is in accountancy :)
- g051051 9y agoGo look up the "#unqualifiedfortech" hashtag on Twitter for the prevailing viewpoint. Hint: no one in tech cares.
- phlakaton 9y agoI hold a music degree and I'm probably a better engineer than you. :-P
- stordoff 9y agoNot directly comparable, but I've known economists who have a far better understanding of security risks than some computer scientists who have received teaching in the area. The lack of a relevant degree isn't exactly a mark in her favour, but it's not a red flag either (especially this far into her career).
- VirtualAirwaves 9y agoThis is one issue our President should take some executive action on, if at all possible. At the very least, people should not be charged for credit freezes for the next few years, and existing laws should be reviewed. Taking action against Equifax would be supported by the vast majority of Americans.
- g051051 9y agoNot something for a president...it's a congressional thing.
- dsfyu404ed 9y agoHe can direct the FBI and justice department to interpret the law with regard to equifax the way they would interpret it for a small business or individual. (obviously under the table because above the table would acknowledge the double standard)
- vkou 9y agoThere is a solution to this problem - the Freedom from Equifax Exploitation Act, drafted by senators Elizabeth Warren and Brian Schatz. Naturally, not a single republican supports this legislature.
- SubiculumCode 9y agoCowards with golden parachutes: Modern Capitalism.
- Lapsed 9y agoI see you didn't read the article.
- SubiculumCode 9y agoI stand corrected. Thanks.
- aaroninsf 9y agoIn other large countries of note, responsibility for a billion dollar crisis and abuse of private data would result in life-ending jail time. They have a point. This ass hat enriched himself at the expense of customers held at gun point, and didn't even oversee due diligence in the execution of a bullshit monopoly. Retiring to ride horses and pensively stare at the far horizon of one of his ranches and come back with think piece hagiography in 4 years on the lessons learned... ...there should be bigger consequences.
- Animats 9y agoWith $18.4 million in pension benefits.
- pmarreck 9y agoThis guy is an asshole.