Equifax doesn't store medical data, so HIPAA doesn't apply. Here's the thing: short of some California disclosure laws, it isn't clear that Equifax broke any

Equifax doesn't store medical data, so HIPAA doesn't apply. Here's the thing: short of some California disclosure laws, it isn't clear that Equifax broke any laws, or even any contracts. They don't have any particular duty to protect the data they have about you, other than protecting their own IP. Equifax is a clearing house for information that people say about you. Look, if I follow you around, reporting all your movements, write it down, and then my notes about you get posted on the internet, what law did I break? (Equifax used to report "his marital troubles, jobs, school history, childhood, sex life, and political activities", so it isn't that far of a stretch). Given that perspective, it makes sense that they would protect the data as much as any data vendor would. Certainly they didn't predict the PR backlash such a failure would cause and should have factored that in.