Why Equifax's breach needs regulation

Equifax, you had one job. Your only purpose as a corporation, the reason you were created and remain a going concern, is to collect and maintain people’s most private financial data.

Now you have fallen down on your only job — and spectacularly so. Hackers penetrated the spectral gauze of security surrounding your website, and over the course of nearly two months, they made away with the personal information of as many as 143 million Americans.

It is the most important financial data available on any of us. So, Equifax, I have to ask: Now that you have failed at your one job, why should you be allowed to keep doing it?

If a bank lost everyone’s money, regulators might try to shut down the bank. So if a data-storage credit agency loses pretty much everyone’s data, why should it be allowed to store anyone’s data any longer?

Here’s one troubling reason: Because even after one of the gravest breaches in history, no one is really in a position to stop Equifax from continuing to do business as usual.

Experts said it was highly unlikely that any regulatory body would shut Equifax down over this breach.

As one of the nation’s three major credit-reporting agencies, which store and analyse consumers’ financial history for credit decisions, it is likely to be considered too central to the American financial system; Equifax’s demise would both reduce competition in the industry and make each of the two survivors a bigger target.

Raj Joshi, an analyst at Moody’s, said in a note to investors that Equifax was likely to be fine, as “the impact of the security breach will only modestly erode its solid credit metrics and liquidity.”

The two regulators that do have jurisdiction over Equifax, the Federal Trade Commission and the Consumer Financial Protection Bureau, declined to comment on any potential punishments over the credit agency’s breach.

Consumers also have piddling rights over how Equifax may continue to use their credit data.

This isn’t just about Equifax. We live in the age of Big Data. We have allowed, mostly passively, the emergence of huge and exquisitely detailed databases full of information about all of us.

“It is troubling that Equifax is forcing people to waive legal rights in order to receive fraud monitoring after the company’s breach put their personal information at risk,” Samuel Gilford, a bureau spokesman, said in a statement.

With all these ways of mitigating fallout from attacks, breaches keep happening. See Yahoo, for instance, which hackers hit for 500 million accounts, and then again for 1 billion accounts — but which is still in business.

But Equifax? It has more of your data than just about anyone else. So even after losing it, it will probably keep just getting more.