Welcome back to the Deep Dive. Today we are peeling
back the layers on a company that is, for most
of us, almost completely invisible. Yet it holds
the digital keys to, well, to our entire financial
lives. We're talking about Equifax Inc. It's
one of those giants, you know, you only really
think about it when you're applying for a mortgage
or maybe worse, when you get that dreaded security
breach notification in the mail. Right. And Equifax
isn't just a player in the game. It's one of
the big three. It's right up there with Experian
and TransUnion on that global stage. Yeah, absolutely.
And the scale, the sheer scale of their operations
is, it's just hard to wrap your head around.
The source material we looked at says Equifax
collects and aggregates information on over 800
million individual consumers worldwide. 800 million.
I mean, let that number sink in for a second.
That's getting close to 10 % of the entire world's
population. And that's just the individuals they're
tracking. Their reach goes way into the corporate
world, too, with data on more than 88 million
businesses across the globe. So what you're describing
isn't just a company. It's more like a foundational
utility, an information utility. It is. It's
a centralized database that modern finance lending,
employment, even insurance. It just can't function
without it. Okay, so our mission today is to
really trace the lineage of this behemoth. How
does a company that's now 126 years old, headquartered
in Atlanta, Georgia, pulling in nearly $5 .7
billion a year, how did it get this kind of irreplaceable
power? And more importantly... Why is that power
so controversial? Why is its history just littered
with these extraordinary security failures, with
insider trading, with legal battles that go back
decades? That's what we're going to get into.
We're going to do a deep dive into the documents
to trace its journey from what was essentially
a local rumor mill operating on gossip and innuendo
to this multinational data giant that was responsible
for one of the biggest data breaches in history.
We really need to understand the systemic failure
here. What happens when the very custodian of
your most sensitive financial identity proves
time and time again to be just consistently negligent?
All right. Let's start at the beginning to really
understand the culture and the problems that
Equifax has today. You have to go way, way back,
back to 1899, which is, you know, a surprisingly
long history for a company whose current issues
are so digital. It is. It started as the retail
credit company or RCC. RCC. Right. And it was
founded by two brothers, Cater and Guy Wolford,
down in Atlanta, Georgia. And you have to understand
the context here. This wasn't about FICO scores
or anything like that. This was an era where
the only way a shopkeeper or a lender could know
if you were trustworthy was by asking around
town, personal references. So the Wolford brothers,
they just formalized that. They built a paid
reference service. Precisely. They created a
business out of checking trustworthiness. And
it worked. By 1920, the RCC model was so successful
they had offices all across the United States
and Canada. They built this massive interconnected
system for gathering information. But the business
model then was much bigger than just checking
if you'd pay back a loan, right? By the 1960s,
RCC was obviously a huge credit bureau with files
on millions of people. But most of its money,
most of its work, was actually coming from reports
for insurance companies. Yes, and for employment
screening. That's a really crucial distinction.
When an insurance company was trying to decide
whether to give you a life insurance policy or
car insurance, they wanted to know a lot more
than just your debt. They'd commission the RCC
to build a whole report on your life. And this
is where it gets... Well, this is where the sinister
side of the retail credit company really starts
to show. It goes from a reference checker to
something more like a surveillance machine. The
source material from that time, it documents
its intense criticism. There were allegations
that the company collected, and I'm quoting here,
facts, statistics, inaccuracies, and rumors about
virtually every phase of a person's life. And
the level of personal intrusion that they monetize
is just genuinely... shocking to a modern sensibility.
These files, these dossiers, they included incredibly
sensitive non -financial information. Like what
are we talking about here? We're talking about
details on your marriage, any marital problems,
your school history, even your childhood, your
sex life, how much you drank, what your political
activities were. It was this huge decentralized
collection of intensely personal, often third
-hand, and completely unverified information
about you. And what the documents show is that
this wasn't even neutral data collection. The
criticism in the 60s and 70s was that RCC employees
were actually rewarded. They were financially
incentivized to collect derogatory information.
Right. They weren't just passively accepting
negative info. They were actively looking for
the dirt. That incentive structure is just, it's
profound, isn't it? Socially, legally. It is.
When you pay people to find negative information,
you create a system that's just ripe for bias
and for discrimination. The sources detail how
these bias reports were used to block people
from getting jobs or housing or insurance. And
it was particularly used to discriminate against
marginalized groups like queer people and people
of color. So if an RCC agent wrote down that
a person was, say, politically active in a way
the client didn't like. that person could lose
their job or be denied a policy, and they'd have
no idea why. No recourse. Zero transparency.
So yeah, the retail credit company wasn't just
some quiet office. It was acting as this major
national gatekeeper, a barrier to opportunity,
all fueled by unverified gossip and a really
perverse financial incentive. A scandal was definitely
brewing, but it was the technology that really
pushed it over the edge. That's the catalyst.
As the company started computerizing its records
in the late 60s, and early 70s, the idea that
all this deeply personal, unverified data could
suddenly be shared instantly across the country,
that became a huge public concern. Which brings
us to a really pivotal moment, congressional
intervention. Exactly. All those alarm bells
led directly to the U .S. Congress holding these
critical hearings in 1970. They were looking
into the practices of the retail credit company
and other credit bureaus, and the seriousness
was clear. Private companies were compiling and
selling this highly invasive data that was directly
affecting people's lives. And it was all happening
without any consumer knowledge or control. The
result of those hearings was the Fair Credit
Reporting Act, the FCRA. This was a landmark
piece of legislation. Oh, it was revolutionary
for American consumer law. The FCRA didn't shut
down the credit bureaus, but for the first time,
it put them under strict federal regulation.
And crucially, it gave consumers fundamental
rights, the right to actually see your own file,
the right to dispute things that were wrong,
and it forced the bureaus to actually investigate
those disputes. It forced transparency and accountability
on what had been a really shadowy system. So
what was the company's immediate response to
all this? Well, the pressure from the hearings,
which had exposed all their invasive and discriminatory
practices, was just too much to ignore. The retail
credit company realized its brand was toxic.
So in 1975, they made a decision to shed that
rumor mill baggage. They changed their name to
Equifax. A calculated PR move. Absolutely. It
was designed to project this new image of, you
know, equity, facts, reliability, anything to
distance themselves from that really controversial
past. And I think it's so important for listeners
to get that this foundational history is crucial.
It sets a precedent, right? This is a company
that was literally born out of a national scandal
and was fundamentally shaped by being forced
into... federal regulation. It's in its DNA.
So Equifax emerges from the ashes of their retail
credit company with this sleek, modern name.
But the core business is still data. And that
data has only become more valuable and you could
argue more intrusive. So for that nearly six
billion dollars in revenue, what does the modern
Equifax actually do? At its heart, it's still
a business to business powerhouse. They aren't
primarily focused on selling you your credit
score for 10 bucks a month. They're selling deep.
deep analytical capabilities, demographic data,
consumer credit and insurance reports, and entire
software platforms to massive clients, banks,
retailers, you name it. Right. So banks, credit
unions, car lenders, big retailers, utility companies,
even health care systems. If you're doing any
kind of transaction that requires checking someone's
financial stability, Equifax is that invisible
third party in the room. And this is where we
need to slow down a bit, because their data collection
goes so far beyond just your credit card payments
and your loans. Equifax has built these non -credit
data streams that give them this incredibly detailed,
almost three -dimensional profile of you. Okay,
so let's break that down. Start with utilities.
You mentioned them. They collect payment history
for things like phone bills and power bills through
a system called NCTUE. Yes, the National Consumer
Telecom and Utilities Exchange. And the NCTUE
is important because it captures behavior that
the main bureaus often miss. It tells a potential
lender if you're reliable in paying your other
bills, your cable, your internet, your electricity.
Being consistent there can be a big data point
for risk, especially for people who don't have
a lot of traditional credit. Equifax really pioneered
gathering this data and centralizing it. But
the real game changer, and maybe the most controversial
part of modern Equifax, is their TELX division.
And specifically... The work number. We cannot
overstate the importance of this. The work number
is, for tens of millions of Americans, the centralized
way to verify your job and your income. Think
about it. When you apply for a mortgage, the
lender needs to verify your salary. In the old
days, they'd have to call your HR department.
But now, they don't have to do that. Now, they
just query the work number. Equifax gets payroll
data directly from tens of thousands of U .S.
companies. We're talking huge corporations, government
agencies, just about everyone. They hold your
current and past salary history, your job titles,
your employment deeds. So Equifax owns the very
infrastructure that verifies whether you can
afford the loan you're asking for. Wow. That's
an almost complete financial identity. They have
your credit history or utility payments and your
definitive salary history. That raises huge questions
about data concentration. Why is this one platform,
the work number, so powerful that it's now facing
an antitrust lawsuit? Its power comes from how
it's basically non -optional. It's centralized.
Because Equifax got exclusive deals with so many
huge employers, they became the single source
of truth for automated employment verification.
So lenders who want speed and efficiency are
heavily pushed or pretty much forced to use the
work number because it's instant. HR departments
can't match that speed. So if a lender wants
to process loans quickly for a huge number of
applicants, they have to pay Equifax. Exactly.
And the source material for the lawsuit argues
this creates a powerful feedback loop. Equifax
uses its dominance in credit data to push lenders
toward its verification services. And the lenders
argue in this new antitrust suit that this lack
of competition lets Equifax charge crazy high
prices for what is now an essential service.
It's an alleged monopoly over the critical step
of confirming your income which is arguably even
more sensitive than your credit history. I would
say so. OK, so despite this huge B2B focus, they
do have some direct to consumer offerings, right?
B2C. Yeah. Since 1999, they've sold things like
fraud prevention, identity theft protection,
credit monitoring services. And of course, they
have to provide that legally mandated free annual
credit report, which all of us are entitled to
under the very same FCRA law that forced their
rebranding all those years ago. And beyond just
dominating in the U .S., Equifax has been aggressively
expanding across the globe through some major
acquisitions. Yeah, their global reach is really
key to their strategy. In 2016, Equifax bought
VEDA, which is the biggest credit agency in Australia
and New Zealand. So that immediately gave them
millions of non -U .S. consumer files. Then in
2023, they moved into South America, buying Boa
Vista Servizos, a major Brazilian credit bureau.
And they also expanded into commercial data,
which is businesses checking on other businesses.
Yes. In 2020, they bought a company called Ansonia
Credit Data. Ansonia is a specialist in commercial
credit, especially in logistics like shipping
and freight companies. So that move helps Equifax
track the financial health, not just of people,
but of the entire supply chains that run the
global economy. They're trying to become the
world's verification utility, period. Which leads
us right to the enormous risk, the inherent liability,
that comes with being an indispensable global
data utility, especially when that utility seems
to consistently neglect its own security. Yeah.
The history of Equifax seems to have this rhythm
to it. They expand, they centralize more and
more power, and then... There's a massive failure.
And that 2016 to 2017 period is probably the
most disastrous failure in the company's entire
126 year history. It just revealed security standards
that were completely incompatible with the data
they held. And what makes this whole saga so
damning is the timeline. The sources we have,
especially that big motherboard report from October
2017, show that security lapses were known about
internally for months before the huge breach
was even found. OK, let's start with that first
warning sign from late 2016. What did that security
researcher find? So around December 2016, a researcher
finds a portal that was only supposed to be for
Equifax employees. But it was completely open
to the public Internet. It was vulnerable because
of a really basic bug called a forced browsing
bug. This is Web Security 101. It means if you
just knew the right URL, you could get to it
without any login. So no fancy hacking tools
needed, just a web browser? That's it. The researchers
said, quote, they didn't have to do anything
fancy. By just playing with the web application,
they claim they could pull millions of customer
records names, social security numbers, dates
of birth in clear text. Clear text, meaning unencrypted.
Unencrypted. They estimated they could have downloaded
all of Equifax's customer data in maybe 10 minutes.
Okay, now here's the part that is just shocking
corporate negligence. The reporting indicates
that even though Equifax got this alert, that
vulnerable portal wasn't actually closed until
June of 2017. That six -month delay is. It's
just critical evidence of a deep... systemic
security problem. It suggests there was no clear
process for fixing things or failure to prioritize
security or just a total breakdown in communication.
That vulnerability was just sitting there for
months, right up to and maybe even during the
time the mega breach was happening. And it's
important to remember that the huge breach wasn't
the only one. There was another separate major
breach in March of 2017 that Equifax only told
a few banking customers about privately. Right.
So this paints a picture of a company that isn't
just dealing with one unlucky attack. It's a
company in an ongoing state of having multiple
poorly defended doors and windows. The big public
one, the May to July 2017 mega breach, was just
the catastrophic finale to all of this neglect.
Let's focus on that one. The pivotal event. This
breach came from a specific known vulnerability
that they just hadn't fixed. The vulnerability
was known as CVE -2017 -5638. It was an exploit
that targeted the Apache Struts web framework,
which is super common in big companies. The vulnerability
wasn't some secret zero day. It was known. And
a patch, a fix for it, had been available since
March 2017. Equifax just didn't apply the patch.
They left a massive door wide open. And what
does that vulnerability actually let a hacker
do? It allows for what's called Remote Code Execution,
or RCE. Basically, it let the attackers upload
their own malicious files, called web shells,
onto Equifax's servers. And once that shell is
on the server, the attackers can send commands
from anywhere in the world. They get access to
the network, and then... to the databases. It's
like leaving the front door key under the mat
with a giant neon sign pointing to it. And once
they were inside, how long did they have free
reign before anyone noticed? The records show
they were inside Equifax's systems, completely
undetected, for about 134 days. 134 days. That's
nearly four and a half months. Four and a half
months that foreign actors had total access to
one of the biggest databases of American financial
identity, just mapping the network, pulling out
data before the breach was finally found and
shut down on July 20th. And the scale of what
they stole is just staggering. It was devastating.
The final numbers were 147 .9 million Americans
affected. But it was a global breach. It also
hit 15 .2 million U .K. residents and about 19
,000 Canadians. And the data wasn't trivial.
It was the building blocks of your identity.
Full names, social security numbers, birth dates,
home addresses, driver's license numbers, and
for some people, their credit card details. This
is the kind of data that enables identity theft
that can last a lifetime. And we even know who
was behind it, which tells you something about
the stakes here. We do. In February 2020, the
U .S. Department of Justice indicted four members
of China's People's Liberation Army for the breach.
China denied any state involvement, of course,
but the indictment points to a highly organized,
state -sponsored operation that was targeting
the crown jewels of U .S. financial data. But
the story of failure doesn't stop with the breach
itself. The aftermath, the post -disclosure phase
revealed a security culture so bad it was almost
comical. It truly was. I mean, think about the
other things that came out at the same time.
Brian Krebs reported on this catastrophic failure
at Equifax's Argentine office. They were maintaining
an online system with private data for about
14 ,000 people. And how was it secured? Remind
us. The security for the Argentine system. The
username and the password were admin and admin.
Just wow. A security failure so basic, so entry
-level, that it points to a total company -wide
failure to just establish and enforce the most
basic security rules across their entire global
operation. And that wasn't the only immediate
mess -up. Their mobile apps were also compromised.
Yep. On the very same day they announced the
massive breach, they had to pull their own official
mobile apps from the app stores. Why? Because
the apps themselves had security flaws, including
being vulnerable to man -in -the -middle attacks
because they were still using insecure HTTP for
some communications instead of HTTPS. It just
shows neglect across the board. And then there's
the awful, terrible irony involving the work
number, that platform with all our salary histories.
The irony is just, it's brutal. The data that
was stolen in the big breach, the social security
numbers and dates of birth, were the exact pieces
of information you needed to access someone's
salary history on the work number website. So
the first breach basically gave the hackers the
keys to unlock a second highly sensitive vault
that Equifax was also supposed to be protecting.
And as if all that wasn't enough. Equifax's own
corporate website got hacked weeks after the
whole world learned about the 148 million record
breach. Correct. Their main public website was
temporarily hijacked to distribute malware. Attackers
compromised a third -party script and used it
to trick visitors into downloading a fake Adobe
Flash update, which was actually malware. And
the fallout from that was immediate. The IRS
suspended a $7 .2 million contract with Equifax
as a direct result of this whole cascade of failures.
So this whole period, it isn't just about one
mistake. It's a complete demonstration of institutional
decay, from ignoring warnings to unpatched servers
to admin -admin passwords, all the way to their
own website spreading malware. A total breakdown.
So given the scale of that disaster, nearly 150
million identities compromised, four months of
undetected hacking, the big question then became...
Accountability, legal accountability, financial
accountability. Right. And regulators around
the world started focusing on that. The first
and maybe most straightforward consequences were
for the executives who tried to personally profit
from it. The insider traders. Yes. Two executives
face charges. Junying, who was the former CIO,
was sentenced to four months in prison plus a
year of supervised release. And he had to pay
over one hundred and seventy two thousand dollars
in fines and restitution. He admitted he sold
his stock after he found out about the breach,
but before it was announced to the public. And
there was another one? Yes. A manager named Sudhakar
Reddy Banthu also pleaded guilty to insider trading.
He got eight months of home confinement. So those
sentences sent a message that trying to profit
from the company's failure would be punished.
But, you know, a lot of people felt the punishment
didn't really fit the crime. But the really big
legal hammer was the global settlement with the
millions of consumers who were affected and all
the regulators. In 2019, Equifax agreed to this
huge global settlement. It involved the FTC,
the CFPB, state attorneys general, and a massive
class action lawsuit. The total amount was capped
at $700 million, with a big chunk of that set
aside for consumer restitution. And this is where
all the consumer frustration really boiled over.
The headlines were all promising $125 cash payment
for every affected consumer. Right. But that
promise pretty much evaporated instantly. The
fine print showed that the $125 was subject to
all these qualifications and hurdles. But the
real reason the payout got so small was the structure
of the class action lawsuit itself. Can you unpack
that for us? Why did a promise of $125 turn into,
what, less than $10? It's a systemic thing with
these huge class action settlements. The total
amount of cash for consumers was a fixed pot
of money. But way more people filed claims than
they expected. And on top of that, the federal
judge had to approve payments for the lawyers
who negotiated the settlement. And the class
action attorneys were awarded about $77 .5 million
for their fees. $77 .5 million. For the lawyers
before the consumers got paid. Correct. So you
take that massive fee out, plus all the administrative
costs of the settlement, and then you divide
what's left among the millions of people who
filed a claim, which led to reports that individual
consumers would end up getting maybe six or seven
dollars. And that huge contrast just fueled this
widespread feeling that this system was really
designed to benefit the lawyers, not the victims.
And outside the U .S., Equifax was also facing
penalties. Yeah, the accountability was global.
In the U .K., for example, their financial conduct
authority fined Equifax over 11 million pounds
in 2023. And that fine was specifically for failing
to protect U .K. customer data in the 2017 breach.
So the negligence was recognized and punished
in every major market they operated. OK, let's
pivot from the security failures to an issue
that is just as chronic. And that was there long
before the breach. the quality of their main
product, data inaccuracy. If you trace the history
of complaints, the problems with data accuracy
are just as systemic as the security flaws. The
sources show Equifax had over 57 ,000 consumer
complaints filed against it with the CFPB just
between 2012 and 2017. And most of those were
about reports being inaccurate, incomplete, or,
and this is the critical one, misattributed,
where your file gets mixed up with someone else's.
And the stories here really illustrate the failure
of their dispute process, which is something
they're required by law by the FCRA to have.
That's the key. The law gives you the right to
dispute an error, and the Bureau must investigate.
But when they fail to investigate or they refuse
to correct what are clearly errors, the consumer's
only option is to sue. And the landmark case
here is from 2013 with a woman in Oregon named
Julie Miller. What happened to her? So Miller
sued Equifax after they repeatedly refused to
fix dozens of false collection accounts that
were on her file. They'd merged her file with
someone else's, even though the other person
had a different social security number and a
different birth date. The false information destroyed
her credit. She was denied loans and a jury originally
awarded her $18 .6 million. $18 .6 million. A
judge later reduced it to $1 .62 million, but
it's still a powerful example of the damage that's
done when the system designed to fix mistakes
just actively resists doing its job. The absurdity
of some of these errors is really what makes
them stick with you. It highlights the real human
cost of bad data management. Absolutely. There's
the famous 2014 case of Kimberly Heyman, who
had to sue Equifax because she was erroneously
reported as being deceased. Can you just imagine
trying to live your financial life, open a bank
account, get a loan, when this massive data company
has officially declared you dead? It's surreal.
Excuse me, I'm not dead. And another case from
2014 involved a man named Godgazarov. He sued
and settled because he claimed Equifax kept reporting
him as having no credit history at all, just
because his first name was unusual and their
automated systems kept flagging it as an error.
These are not small mistakes. They're existential
identity errors that took lawsuits to fix. And
it's crucial to point out, these aren't just
old stories. The data inaccuracy problem is still
happening today. Oh, absolutely. In August 2022,
Equifax admitted that a technical glitch A coding
error caused them to send millions of incorrectly
calculated credit scores to lenders for about
a month. And were these errors significant? Did
they actually affect people? They were significant
enough to change lending decisions. We know from
the class action lawsuits that followed, one
woman alleged the error dropped her score by
130 points. She claimed it directly resulted
in her getting a substantially pricier car loan,
which would cost her thousands more over the
life of the loan. So it shows that whether it's
a huge cyber attack or just a simple internal
glitch, the cost of Equifax's negligence is always
passed directly down to the consumer. Which brings
us right back to the latest legal threat, the
one that challenges their entire business model,
the 2024 antitrust class action lawsuit. This
is a really critical development because this
time the challenge is coming from mortgage lenders
themselves, not from consumers. They're accusing
Equifax of... illegally monopolizing the market
for income and employment verification services.
That's the work number platform we were just
talking about. So the lenders are saying that
because Equifax has this total control over the
central database for salary verification, they
can kill competition and charge artificially
high prices for a service that lenders are now
forced to use. Yeah. And if you look at the big
picture. This lawsuit challenges the very foundation
of Equifax's modern dominance. They use their
power and credit data to acquire and then dominate
employment verification. If the courts agree
that the work number is an illegal monopoly,
it could completely restructure how income is
verified in this country. It could potentially
break up Equifax's dual control over both your
creditworthiness and your earning power. OK,
let's try to synthesize all of this. We've charted
this incredible and often pretty appalling journey
of Equifax Inc. It starts as the retail credit
company, this controversial rumor mill that literally
paid its employees to collect dirt on private
citizens. And we saw how that history of controversy
led directly to being forced into federal regulation
with the Fair Credit Reporting Act. And yet,
despite that. Equifax transformed itself into
this globally indispensable data utility. It
now controls not just credit reports, but also
utility payments. And through the work number,
our actual salary and employment histories. And
this indispensable utility is also consistently
and systemically flawed. We've seen the issues
range from the huge security breaches of 2017,
where they ignored known vulnerabilities, lost
data on 148 million people, and then made these
embarrassing mistakes like the admin admin password
thing. Right. all the way to internal failures
leading to insider trading convictions. And maybe
the most frustrating flaw for the average person
is still the chronic data inaccuracy. Those 57
,000 -plus complaints, the famous lawsuits from
people reported as dead, or denied credit because
of merged files, or given the wrong credit score.
It all paints a picture of an organization whose
legally mandated dispute system just routinely
fails the people it's supposed to protect. So
the vital knowledge to take away from this for
you, the listener, is really understanding that
the stability and the security of your core financial
identity, your ability to get a job, buy a car,
get a fair loan, it's all fundamentally dependent
on a company that has a documented century -long
history of prioritizing its own expansion over
security and accuracy. Which brings us to our
final provocative thought, which is rooted in
that 2024 antitrust lawsuit. If a handful of
companies like Equifax control both your historical
credit data and your your current employment
and salary data through these proprietary systems
like the work number, what does that concentration
of power really mean for all of us? When one
corporation holds the keys to both how much you
owe and the definitive record of how much you
earn, the stakes are existential. So the question
is, what comprehensive regulatory steps are actually
needed to ensure the integrity of these systems
and to prevent one corporation's culture of negligence
from becoming, yet again, an international crisis
for millions of consumers? That's a question
we're thinking about the next time you interact
with the digital infrastructure of finance.