House Panel Issues Scathing Report On 'Entirely Preventable' Equifax Data Breach

An anonymous reader quotes a report from The Hill: The Equifax data breach, one of the largest in U.S. history, was 'entirely preventable,' according to a new House committee investigation. The House Oversight and Government Reform Committee, following a 14-month probe, released a scathing report Monday saying the consumer credit reporting agency aggressively collected data on millions of consumers and businesses while failing to take key steps to secure such information. 'In 2005, former Equifax Chief Executive Officer (CEO) Richard Smith embarked on an aggressive growth strategy, leading to the acquisition of multiple companies, information technology (IT) systems, and data,' according to the 96-page report authored by Republicans. 'Equifax, however, failed to implement an adequate security program to protect this sensitive data. As a result, Equifax allowed one of the largest data breaches in U.S. history. Such a breach was entirely preventable.'

The report blames the breach on a series of failures on the part of the company, including a culture of complacency, the lack of a clear IT management operations structure, outdated technology systems and a lack of preparedness to support affected consumers. 'A culture of cybersecurity complacency at Equifax led to the successful exfiltration of the personal information of approximately 148 million individuals,' the committee staff wrote. 'Equifax's failure to patch a known critical vulnerability left its systems at risk for 145 days. The company's failure to implement basic security protocols, including file integrity monitoring and network segmentation, allowed the attackers to access and remove large amounts of data.' The Oversight staff found that the company not only lacked a clear management structure within its IT operations, which hindered it from addressing security matters in a timely manner, but it also was unprepared to identify and notify consumers affected by the breach. The report said the company could have detected the activity but did not have 'file integrity monitoring enabled' on this system, known as ACIS, at the time of the attack.

Read more of this story at Slashdot.