4 ms·
> In 2005, former Equifax Chief Executive Officer (CEO) Richard Smith embarked on an aggressive growth strategy, leading to the acquisition of multiple companie
by mbesto 8y ago
> In 2005, former Equifax Chief Executive Officer (CEO) Richard Smith embarked on an
aggressive growth strategy, leading to the acquisition of multiple companies, information
technology (IT) systems, and data. While the acquisition strategy was successful for Equifax’s
bottom line and stock price, this growth brought increasing complexity to Equifax’s IT systems,
and expanded data security risks.
> Second, Equifax’s aggressive growth strategy and accumulation of data resulted in a
complex IT environment. Equifax ran a number of its most critical IT applications on custombuilt legacy systems. Both the complexity and antiquated nature of Equifax’s IT systems made
IT security especially challenging. Equifax recognized the inherent security risks of operating
legacy IT systems because Equifax had begun a legacy infrastructure modernization effort. This
effort, however, came too late to prevent the breach.
As someone who works in Tech M&A, I often tell clients "hackers go after the weakest link and you just acquired a new link". They nearly unilaterally ignore this advice and ignored hardening even the smallest of acquisitions, because well, "growth". Someday people will learn.
- westmeal 8y ago... unfortunately I don't think people are going to learn this anytime soon.
- dv_dt 8y agoIf you start with the accounting assumptions that work on security is a cost, and storing of private data is not a liability then all the actions are rational within the narrow scope of profit optimization. (I'm not in agreement of this, but it seems to be true). Equifax holds these assumptions even more strongly because their fundamental existence is founded on monetization of private data.
- nawtacawp 8y agoThis afteraction also validates breaches are not a liability, in the end their sharevalue recovered nearly immediately.
- rorykoehler 8y agoData is always a liability unless it is the core component which drives value in your business (ie you are Google or Facebook).
- Twirrim 8y ago> Someday people will learn. Not convinced of this at all. There just isn't sufficient financial incentive.
- porphyrogene 8y agoIf you are small and have no government support you have to learn in order to survive. If you are monolith like Equifax and you only have to explain yourself to people who are openly soliciting campaign contributions (read: bribes) then learning is a waste of time when you can just buy off the politicians and buy out the little guys who are doing things better.
- arduanika 8y agoWell at least the i-bankers who managed those acquisitions will be punished in a way that updates their incentive function for next time. /s