Could Equifax be the dumbest company on the planet?

Equifax is now using a 3rd party "settlement administrator" to check claim eligibility from their infamous breach. Here's the thing. They're using a non-equifax.com privately registered domain to collect this info. It's also domain control validated vs. an extended cert showing ownership: https://eligibility.equifaxbreachsettlement.com/en/eligibility They request your last name and the last 6 digits of your social. Obviously, anyone can set up a private domain and phish the hell out of people. This is exactly Equifax's behavior after the initial incident, whereupon they setup a plethora of privately registered domains intended to mitigate the issue. Why are they training people to be phished? Have they learned nothing?