4 ms·

What kind of punishment is it if they can continue to operate unharmed after it? What’s the incentive to actually do better?

credit_guy 7y ago
I'm not very familiar with this case, but a quick google shows me they are subject to at least two consent orders [1], [2]. The statements of the consent orders are almost identical, however the implication is that Equifax will have to persuade multiple regulators that they fulfill the conditions. The requirements of the consent order are what you'd expect: firm up your internal controls, and do everything possible to prevent another breach. For example here's the first requirement: "1)Within 90 days from the effective date of this ORDER, the Board shall review and approve the written risk assessment that identifies:(a)foreseeable threats and vulnerabilities to the confidentiality of personally identifiable information (PII)1;(b)the likelihood of threats;(c)the potential damage to the Company’s business operations; and(d)the safeguards and mitigating controls that address each threat and vulnerability." So, what's going to happen is that between now and the time the consent orders are closed Equifax will spend hundreds of millions of dollars to convince the regulators that they are atoning for their sins. You will actually be able to track this in their 10Q and 10K disclosure forms. For example in their most recent quarterly filling ([3], p. 5) you can see the item Selling, general and administrative expenses at $1.3 BN compared to the same quarter in 2018 (i.e. before they entered the consent order) when it was at $0.6 BN. That's $700 MM right there. Could it be the settlement? I don't know for sure, but there's another $700 MM the quarter before ([4], p.5). [1] https://www.sec.gov/Archives/edgar/data/33185/000119312518205827/d152675dex991.htm https://www.sec.gov/Archives/edgar/data/33185/00011931251820... [2] https://dbf.georgia.gov/sites/dbf.georgia.gov/files/related_files/press_release/Equifax-Final-Consent-Order_6-25-18.pdf https://dbf.georgia.gov/sites/dbf.georgia.gov/files/related_... [3] https://otp.tools.investis.com/clients/us/equifax/SEC/sec-show.aspx?FilingId=13552460&Cik=0000033185&Type=PDF&hasPdf=1#EFX10Q20190630_HTM_S1624D5EDDB325C80B9421F326F9DF07E https://otp.tools.investis.com/clients/us/equifax/SEC/sec-sh... [4] https://otp.tools.investis.com/clients/us/equifax/SEC/sec-show.aspx?FilingId=13421771&Cik=0000033185&Type=PDF&hasPdf=1 https://otp.tools.investis.com/clients/us/equifax/SEC/sec-sh...
lern_too_spel 7y ago
The company has to spend at least $1 billion on cybersecurity measures over the next five years.
- londons_explore 7y ago
  That won't harm them much. That'll pay the entire engineering department's salary from it, something they were going to pay for anyway.

credit_guy 7y ago

I'm not very familiar with this case, but a quick google shows me they are subject to at least two consent orders [1], [2]. The statements of the consent orders are almost identical, however the implication is that Equifax will have to persuade multiple regulators that they fulfill the conditions. The requirements of the consent order are what you'd expect: firm up your internal controls, and do everything possible to prevent another breach. For example here's the first requirement: "1)Within 90 days from the effective date of this ORDER, the Board shall review and approve the written risk assessment that identifies:(a)foreseeable threats and vulnerabilities to the confidentiality of personally identifiable information (PII)1;(b)the likelihood of threats;(c)the potential damage to the Company’s business operations; and(d)the safeguards and mitigating controls that address each threat and vulnerability." So, what's going to happen is that between now and the time the consent orders are closed Equifax will spend hundreds of millions of dollars to convince the regulators that they are atoning for their sins. You will actually be able to track this in their 10Q and 10K disclosure forms. For example in their most recent quarterly filling ([3], p. 5) you can see the item Selling, general and administrative expenses at $1.3 BN compared to the same quarter in 2018 (i.e. before they entered the consent order) when it was at $0.6 BN. That's $700 MM right there. Could it be the settlement? I don't know for sure, but there's another $700 MM the quarter before ([4], p.5). [1] https://www.sec.gov/Archives/edgar/data/33185/000119312518205827/d152675dex991.htm https://www.sec.gov/Archives/edgar/data/33185/00011931251820... [2] https://dbf.georgia.gov/sites/dbf.georgia.gov/files/related_files/press_release/Equifax-Final-Consent-Order_6-25-18.pdf https://dbf.georgia.gov/sites/dbf.georgia.gov/files/related_... [3] https://otp.tools.investis.com/clients/us/equifax/SEC/sec-show.aspx?FilingId=13552460&Cik=0000033185&Type=PDF&hasPdf=1#EFX10Q20190630_HTM_S1624D5EDDB325C80B9421F326F9DF07E https://otp.tools.investis.com/clients/us/equifax/SEC/sec-sh... [4] https://otp.tools.investis.com/clients/us/equifax/SEC/sec-show.aspx?FilingId=13421771&Cik=0000033185&Type=PDF&hasPdf=1 https://otp.tools.investis.com/clients/us/equifax/SEC/sec-sh...

lern_too_spel 7y ago

The company has to spend at least $1 billion on cybersecurity measures over the next five years.

londons_explore 7y ago
That won't harm them much. That'll pay the entire engineering department's salary from it, something they were going to pay for anyway.