Congress rips ex-Equifax CEO over breach: 'I don't think we can pass a law that ... fixes stupid'

Ex-CEO Richard Smith received an earful on Capitol Hill Tuesday over Equifax's response to its data breach.

Lawmakers shamed former Equifax CEO Richard Smith Tuesday over the company’s humongous data breach, scolding him over everything from allowing the breach to happen to the long list of issues that stemmed from the company’s public response.

Smith took questioning from the House Energy and Commerce’s Subcommittee on Digital Commerce and Consumer Protection, the first of three breach-related hearings scheduled for this week. While the panel lambasted him for the company’s actions,  Smith offered little details outside of his prepared testimony.

In an exchange with Rep. Greg Walden, R-Ore., Smith explained that the breach occurred because IT and security personnel at Equifax failed to find and patch the software vulnerability after being notified by the Department of Homeland Security.

“It appears this breach happened because the company didn’t know it was running certain software on it’s system,” Walden said. “How does this happen when so much is at stake? I don’t think we can pass a law that – excuse me for saying this – fixes stupid.”

When asked by multiple representatives on the panel about what consumers can do to protect themselves in the attack’s wake, Smith reiterated that Equifax is offering free services to all Americans to monitor and protect their credit information.

According to Smith, DHS’s Computer Emergency Readiness Team (US-CERT) notified the credit monitoring agency on March 8 of a software vulnerability in Apache Struts, the open-source application Equifax was using in its online consumer disputes portal.

Smith said it wasn’t until July 29 that Equifax detected suspicious activity on the website. After failing to block the suspicious traffic, Equifax took down the site. Smith said he was notified for the first time on July 31, but that it wasn’t clear until August 15 that personal information was stolen.

The company announced on Sept. 7 that 143 million may be affected. That number went up to 145.5 million on Monday.

The CEO also fielded questions about Equifax’s website set up after the breach was made public. That site wasn’t owned by Equifax and was riddled with security flaws.

“This was extremely challenging given that the company needed to build a new capability to interface with tens of millions of consumers, and to do so in less than two weeks. That challenge proved overwhelming, and, regrettably, mistakes were made,” Smith said in his testimony.

On Monday, the subcommittee’s ranking Democrat, Jan Schakowsky of Illinois, reintroduced a bill entitled the Secure Protect Americans’ Data Act, “which seeks to enhance data security and require prompt notification and ongoing assistance to consumers in the event of a breach,” according to a statement on her website.

“Equifax deserves to be shamed in this hearing, but we should also ask what Congress has done to stop data breaches from occurring,” Schakowsky said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure