CEOInterviews.AIEquifax CEO Richard Smith Testifies On Hacking That Compromised Millions Of Americans Personal Info

N

Narrator0:00

Today on Capitol Hill, Richard Smith, the former chairman and CEO of Equifax, began the first of three straight days of hearings to address the recent data breach which exposed the private information of more than 145 million people. This House Energy and Commerce Subcommittee hearing runs about three hours.

B

Bob Latta0:23

Good morning. The Subcommittee on Digital Commerce and Consumer Protection will come to order. The chair recognizes himself for five minutes for an opening statement. Good morning. Today we are here to get the facts, to learn what happened at Equifax that led to the personal information of over 143 million Americans' information being stolen. Americans deserve to know what Equifax is doing to fix the problem and help individuals that are impacted. Let's find out what happened. The public deserves to know what happened and what steps are being taken to protect their sensitive data going forward. Today's hearing needs to shed some much-needed information and light on this breach. We've received assurances from Equifax that Mr. Smith can speak for the company on concrete remediation steps that the company took in the aftermath to secure its computer systems and to protect the affected US customers, as well as what happened when he was chief executive. As chairman of the Digital Commerce and Consumer Protection Subcommittee, I often speak about the fact that we live in a digitally connected world. That fact of life can have many positive implications far and wide ranging for commerce, trade, communications, and entertainment. The breach is a massive reminder of the bad actors that are out there and the security challenges confronting our digitally integrated and data-powered economy. In this case, sensitive personal information that is used to build credit histories and allow individuals to engage in commerce, open credit cards, buy cell phones and appliances, and secure mortgages has been compromised. Reasonable security measures must be implemented, practiced, and continually improved by companies that collect and store data in order to guard against unauthorized access to sensitive personal information. Otherwise, consumers will face substantial financial harm. This risk is deeply concerning to me and I know that the other members of the subcommittee share this view. Priority number one: we must protect Americans who work to safeguard their personal information online. The recent Equifax data breach is unprecedented, and it is also unique because of the sensitivity of the information stolen, including full nine-digit Social Security numbers. Over 143 million Americans are potentially impacted. This represents approximately 44 percent of the total US population. In my home state of Ohio, approximately 5.2 million customers are likely affected based on the information released by Equifax. We are informed that massive amounts of personal and financial information was accessed from mid-May through July 2017, including names, birth dates, addresses, and in some cases driver's license information. In addition, over 200,000 people had their credit card information stolen, and over 180,000 people had credit dispute documentation stolen. This is a staggering amount of sensitive personal information. It impacts an extraordinary number of credit-viable Americans that is in the hands of criminals that could result in fraud or identity theft. We need these numbers confirmed today. We must understand the following: first, how did the hackers get access to the system for so many weeks and pull so much information out of the system without being detected? Second, what processes and procedures were in place in the event of such a breach, and were those processes followed? There are many questions as to who knew what and when this information was known. This will have implications in other ongoing investigations. Further, the chief information officer and chief security officer made retirement announcements shortly after the public notice of the breach and haven't been available for questions about their role. Again, despite months of delay, why was Equifax's notification and consumer protection processes still a mess, with misinformation, glitches, and overall confusion? For example, there are numerous reports of difficulties accessing Equifax's dedicated website or call centers, and there were dismaying reports that the official Equifax Twitter account directed consumers to a fake website. I believe the American public deserves to know the facts about when Mr. Smith, the company management, and the Board of Directors were made aware its systems were vulnerable to hackers and how over 143 million sensitive personal data records were stolen. To that end, what were the steps taken and in what time frame to notify and help individuals that were impacted? I look forward to getting these answers today and many more questions for the American people answered this morning. And at this time, I will ask the gentlelady from Illinois, the ranking minority member, for five minutes for her opening statement.

J

Jan Schakowsky5:25

Thank you, Mr. Chairman, for holding this hearing. The Equifax data breach was massive in scale: 145.5 million American victims as of yesterday. I would call it shocking, but is it really? We have these unregulated, private, for-profit credit reporting agencies collecting detailed personal and financial information about American consumers. It's a treasure trove for hackers. Consumers don't have a choice over what information Equifax, or for example TransUnion or Experian, have collected, stored, and sold. If you want to participate in today's modern economy, if you want to get a credit card, rent an apartment, or even get a job, often a credit reporting agency may hold the key. Because consumers don't have a choice, we can't trust credit reporting agencies to self-regulate. It's not like when you get sick at a restaurant and decide not to go there anymore. Equifax collects your data whether you want to have it collected or not. If it has incorrect information about you, it's really an arduous process — I've tried it — to get it corrected. When it comes to information security, you are at the mercy of whatever Equifax decides is right. And once your information is compromised, the damage is ongoing. Given the vast quantity of information and lack of accountability, a major breach at Equifax, I would say, would be predictable if not inevitable. I should really say breaches: this is the third major breach Equifax has had in the past two years. From media reports and the subcommittee's meeting with Equifax officials after the breach, it is clear to me that the company lacked appropriate policies and practices around data security. This particular breach occurred when hackers exploited a known vulnerability that was not yet patched. It was months later before Equifax first discovered the breach, and it was another several weeks before Equifax shared news with the consumers, this committee, the Federal Trade Commission, and the Consumer Financial Protection Bureau. Senior officials at the company are saying they weren't immediately aware that the breach occurred, and yet, by the way, there were executives who sold over a million dollars in stock just days after the breach was discovered but yet not reported. And for a lot of Americans, that just doesn't pass the smell test. The response to the breach was its own debacle. Equifax offered consumers credit monitoring services that initially came with a mandatory arbitration clause, which fortunately has been corrected. Equifax tweeted links to the wrong URL, directing victims to a fake website. The call center was understaffed, and Equifax has had to apologize for its post-breach response almost as much as it has apologized for the breach itself. Equifax deserves to be shamed in this hearing, but we should also ask what Congress has done or failed to do to stop data breaches from occurring, and what Equifax plans to do. The same day that the Equifax breach went public, the House Financial Services Committee held a hearing on the VRIC Liability Harmonization Act, a bill to protect credit reporting agencies like Equifax from class-action suits. Imagine, in fact, Equifax was lobbying for this bill after the breach was discovered in July, still not reported. And for the 14 Republicans sponsoring this bill, they should ask themselves whether this is really the industry they want to be in bed with. Companies like Equifax need more accountability, not less. I agree with the CFPB director Richard Cordray that the credit reporting agencies need embedded regulators to protect consumers' sensitive information, and then we need to go further. Last night, I reintroduced the Secure and Protect Americans' Data Act, along with Ranking Member Pallone and seven other members of the Energy and Commerce Committee. Our bill would establish strong data security standards, require prompt breach notification — which we didn't get — and provide appropriate relief for breach victims. Chairman Latta, American consumers don't just need answers, they need action. I hope that our bill can be a starting point for discussion on strengthening protections for Americans' data. Consumers deserve a whole lot better than they got from Equifax. I yield back.

B

Bob Latta10:37

Thank you much. The gentlelady yields back. The chair now recognizes the gentleman from Oregon, the chairman of the full committee, for five minutes.

G

Greg Walden10:45

I thank the chairman. We're here to do today what it appears Equifax failed to do over the last several months, and that's put consumers first. Our job is to get answers for the more than 145 million Americans who have had their personal information compromised and now fear they could be victims of fraud at any time. How could a major US company like Equifax, which holds the most sensitive and personal data on Americans, so let them down? It's like the guards at Fort Knox forgot to lock the doors and failed to notice the thieves were emptying the vaults. The American people deserve to know what went wrong. We want a clear timeline of events and to understand what to expect moving forward. As chairman of the Energy and Commerce Committee, I've always tried to put our consumers first in everything we do on public policy. So today we'll begin to get the answers for the public, hold Equifax accountable, and make clear that businesses holding America's most sensitive data have a responsibility under existing laws to protect those data. Today gives whole new meaning to 'Mr. Smith Goes to Washington.' It's not a run on the bank that's at issue; it's a run on financial records of 145 million Americans, and the consequences and the inconveniences for our fellow citizens is every bit as important to discuss today as the reasons behind why this breach occurred in the first place. Mr. Smith, as former chairman and CEO of Equifax, at the helm during and immediately after the breach, we appreciate your being here and we expect your candor and full cooperation as we march toward getting the facts in this case. While there's no such thing as perfect security, companies do have a legal obligation to protect sensitive consumer data. This diligence is necessary to both comply with existing laws and, maybe more importantly, earn and keep the public's trust in a data-driven economy. Given the size of the breach and the sensitivity of the data, we expect to learn more about how Equifax failed to secure its systems and what contingency plans were in place. Further, we need to understand how information flowed through the organization and when you and other senior executives were notified about the breach. In other words, how important was cybersecurity to you as a CEO and to the rest of your executive team? Did your employees have a way to report to you if they had concerns about how the security team was functioning? While there are still many questions that need answers, a few details have emerged. First, the vulnerability that the hackers used to get into the Equifax system was discovered in early March. From the beginning, the vulnerability was described as critical and easily exploitable. That information was pushed out through multiple security information sharing channels, including by the US Computer Emergency Readiness Team, to Equifax's chief security officer. For some period of time between March and August of 2017, the hackers were able to sit on Equifax's system and siphon out 145 million records without being detected. How did this go unnoticed? Further, is there a process in place to raise flags or alarms when massive amounts of data are pulled out of the Equifax system? Then there are questions about Equifax's response for consumers that we need answers to. Why was the consumer-facing website created on a separate domain from the main Equifax website? Did anyone raise concerns about creating more consumer confusion with a separate website? Were consumers able to sign up for the products offered by Equifax today? How many consumers have placed a fraud alert on their account or frozen their credit? And on top of all the other issues, multiple times Equifax tweeted the wrong URL, directing consumers to the wrong website to check if they were part of the breach. Talk about ham-handed responses. This is simply unacceptable, and it makes me wonder whether there was a breach response plan in place at all, and if anyone was in charge of overseeing and executing that plan. I have to agree with the interim CEO when he said there's insufficient support for consumers. It's important that as Congress does its work on public policy issues, that the Federal Trade Commission and other agencies, including law enforcement agencies, continue their work, especially in light of recent reports that indicated there are markers of nation-state activity involved with this hack. But today, Mr. Smith, I and the rest of the committee, and Congress, and the country expect the answers. After all, the buck does stop with you as CEO. And I thank you for being here. I return the balance of my time.

B

Bob Latta15:25

And the chair now recognizes the gentleman from New Jersey, the ranking member of the full committee.

F

Frank Pallone15:31

Thank you, Mr. Chairman. While I understand that law enforcement and internal investigations into this incident are still ongoing, I expect to get more information today on what happened and why it took so long to inform the public. Most importantly, we need answers for consumers, because Equifax's response to this breach has been unacceptable. So too has been Equifax's ongoing lackadaisical attitude when it comes to protecting consumer data. It's been four weeks since the breach was made public and at least ten weeks since it was discovered by Equifax employees, yet Equifax's customer service has been confusing and unhelpful. Equifax even tweeted a link to a fake website. Many of the remedies Equifax is now offering to consumers were not offered upfront or in good faith; they were forced out of the company only after a public outcry, and they are still inadequate. It's hard to imagine that anyone at Equifax thought it was a good idea to offer only one year of credit monitoring with an arbitration clause at first, to boot. Free and comprehensive credit monitoring and identity theft protection should be offered for far longer than a year. Most recently, Equifax added lifetime credit locks to its offering, which consumer advocates suggest are weaker than credit freezes. Regardless, a lock or a freeze that only one credit bureau offers is almost useless. Equifax should work with the other credit bureaus to immediately create a free, quick, and easy-to-use freeze and unfreeze one-stop shop. And because credit freezes or locks may not work for everyone going forward, Equifax should do more than credit locks; it should give consumers more control over how their data is used and stored. In addition, if Equifax wants to stay in business, its entire corporate culture needs to change to one that values security and transparency. After all, this is not Equifax's first data breach in the past year. Consumers did not have any say in whether Equifax collects and shares their data, and that's what makes this breach so concerning. This is unlike other breaches at stores such as Target and Michaels, where consumers could make a choice and change their shopping habits if they were upset with how the company protected data. That's simply not the case with Equifax. While data breaches have unfortunately become commonplace, it's long past time for Congress, beginning with this committee, to act. Since at least 2005, this subcommittee has been considering data breach legislation, but it's never become law, and it's time we change that. Yesterday, Ranking Member Schakowsky and I reintroduced the Secure and Protect Americans' Data Act. This bill would require enforceable, robust data security practices and meaningful notice to consumers. It would also give additional protections to consumers after a breach. Of course, breaches will continue to occur, but they occur more often when there is no accountability and no preventive measures are in place. Our bill will not stop mistakes and cyber crimes from happening, but we need to start somewhere. So, Mr. Smith, I read your op-ed in USA Today last month and the new CEO's op-ed in the Wall Street Journal last week, and I appreciate that you're both sorry, but my question is: what now? I'd like to yield the remainder of my time to my colleague from New Mexico.

B

Ben Ray Luján18:52

Thank you to our ranking member, Mr. Pallone, and I thank the committee's leadership for organizing this important hearing. 145.5 million Americans — 145.5 million people at risk because of Equifax's failure. Now, Mr. Smith, the American people deserve answers, and I hope you are prepared to provide them, not just about what caused the breach, but what Equifax is doing to prevent this from happening again and to ensure that those who were harmed are made whole. I worry that your job today is about damage control, to put a happy face on your firm's disgraceful actions and then depart with a golden parachute. Unfortunately, if fraudsters destroy my constituents' savings and financial futures, there's no golden parachute awaiting them. We have questions, and it's our expectation that you have concrete answers. I hope this hearing is just the start of our committee's work. We need to work together to hammer out real solutions. I recently took a step in that direction by introducing the Free Credit Freeze Act to allow consumers to protect themselves by freezing and unfreezing their credit at no charge. It is unconscionable that Equifax failed so spectacularly to protect people's most sensitive personal data. It's even more reprehensible that the same company profits from the pain that they have caused. I certainly hope that we can get some assurances from the committee's leadership that we will have a markup and a hearing on legislation to address this mess, and I hope that that assurance can be given before the holidays of 2017. I yield back the balance of my time.

B

Bob Latta20:47

Thank you very much. The gentleman yields back. This concludes the member opening statements. The chair would remind members that pursuant to the committee rules, all members' opening statements will be made part of the record. Today we have Mr. Richard Smith, the former chairman and CEO of Equifax Inc., who is here to testify before the subcommittee. Mr. Smith will have the opportunity to give an opening statement, followed by a round of questions from our members. Mr. Smith, you are recognized for five minutes.

R

Richard Smith21:19

Thank you. Thank you, Chairman Walden, Ranking Member Pallone, Chairman Latta, Ranking Member Schakowsky, and the honorable members of the subcommittee. It's an honor to be here before you today. My name is Rick Smith, and for the last 12 years I have had the honor of being the CEO and the chairman of Equifax. Earlier this week I submitted a written testimony, which at this time I don't plan on going through in any detail. Rather, I'm here today to explain to you and the American people how criminal hackers were able to steal personal information on over 145 million Americans from our servers, and as importantly, to discuss with you today what the company's response was to that criminal hack. The criminal hack happened on my watch, and as CEO, I'm ultimately responsible, and I take full responsibility. I'm here today to say to each and every person affected by this breach, I'm truly and deeply sorry for what happened. I've talked to many consumers, I've read your letters, and Equifax is committed to make it whole for you. Americans have a right to know how this happened. I'm prepared to testify today about what I've learned and what I did about this incident and my role as CEO and chairman of the board, and also what I know about the incident as a result of being briefed by the company's investigation, which is ongoing. We know now that this criminal attack was made possible because of a combination of human error and technological error. Human error involved a failure to apply a software patch to our dispute portal in March of 2017. Technological error involved a scanner which failed to detect that vulnerability on that particular portal. Both errors have since been addressed. On July 29th and July 30th, suspicious activity was detected, and the team followed our security incident protocol. The team immediately shut down the portal and began our internal security investigation. On August 2nd, we hired top cybersecurity forensic and legal experts. At that time, we notified the FBI. To be clear, we did not know the nature or the scope of the incident. It was not until late August that we concluded that we had experienced a major breach. Over the weeks leading up to September 7th, our team continued working around the clock to prepare. We took four steps to protect consumers. Step number one: determining when and how to notify the public, relying on the advice of our experts that we needed to have a plan in place as soon as we announced. Step two: helping consumers by developing a website, staffing up massive call centers, and offering services free to every American. Step three: preparing for increased cyber attacks, which we were advised by the cybersecurity experts that we should expect. And finally, continue to coordinate with the FBI and their criminal investigation of the hackers, and also to notify other federal and state agencies. In the rollout of our remediation program, mistakes were made, which again I deeply apologize. I regret the frustration that many Americans felt when our websites and call centers were overwhelmed in the early days. It's no excuse, but it certainly did not help that Hurricane Irma took down two of our larger call centers in the first few days after the breach. Since then, however, the company has dramatically increased its capacity, and I can report to you today we've handled over 420 million consumer visits to our website in just over three weeks, and the wait times at the call centers have been substantially reduced. At my direction, the company offered a broad package of services to all Americans. In addition, we developed a new service available on January 31st, 2018, that will give all consumers the power to control access to their credit data by allowing them to lock and unlock their credit files when they want. They can do that for free for life. Putting the power to control access to credit data in the hands of the American consumer is a step forward. I look forward to discussing this new tool with you during my testimony. As we've all painfully learned, data security is a national security problem. Putting the consumer in control of their credit data is a first step towards a long-term solution to the industry problem of identity theft. No single company can solve a larger problem on its own. I believe we need a public-private partnership to evaluate how to best protect Americans' personal data going forward. I look forward to being a part of that dialogue. Chairman Walden, Ranking Member Pallone, Chairman Latta, Ranking Member Schakowsky, and the honorable members of the subcommittee, thank you again for inviting me here today to speak to you. I will close by saying again how sorry I am for this breach. On a personal note, I want to thank the many hard-working and dedicated employees who worked with me so tirelessly over the past 12 years at Equifax. Equifax is a very good company with thousands of great people waking up every day trying to do what is right. I know they'll continue to work tirelessly as we have over the past two months to right the wrong. I'm looking forward to answering your questions. Thank you.

B

Bob Latta28:02

Thank you very much. This concludes our witness testimony. We'll move into the question and answer portion of our hearing. I'll begin with the questioning. I recognize myself for five minutes, and I would remind members, because we do have quite a few members, when I ask questions today, I'm going to try to keep the five-minute rule on questions in place, so you'll hear the tapping. But I will begin with the questioning. Mr. Smith, the timeline of events is raising red flags. I would like to ask you about it. According to your statement, the first time you heard about the breach of security was on July 31st of 2017. Is that correct?

R

Richard Smith28:42

Yes, Congressman. That is correct.

B

Bob Latta28:44

And you first asked for a briefing about the breach on August 15th. Is that correct?

R

Richard Smith28:54

Yes, that is correct.

B

Bob Latta28:57

And the first time the board of directors was notified about the breach was August 24th. Is that correct?

R

Richard Smith28:59

The full board, Congressman? On the 22nd of August, I notified our lead director, presiding director at that time. The full board was briefed on the 24th, again on the 25th, and subsequent meetings after that.

B

Bob Latta29:11

All right. And you notified the public about the breach on September 7th. Correct?

R

Richard Smith29:16

That is correct.

B

Bob Latta29:18

Okay. You state in your testimony that you began developing the remediation for consumers on August 24th or 25th. Why was there a 10-day delay between you finding out that personal information had likely been stolen and beginning to develop the remediation plan? And do you think that 10-day window was responsible for having learned about that personal information being stolen to start talking about how to talk to the consumers?

R

Richard Smith29:41

Congressman, I understand the question. If I may go back to the time frame of the 31st. So together, on the 29th and 30th, someone at security had detected what they deemed a suspicious activity. That is something that happens routinely around our business. On the 30th, they brought down this particular portal and they started their own internal investigation. As I had mentioned in my opening comments and in my written testimony, on the 2nd of August, they had engaged leading forensic experts, cyber experts, and leading King & Spalding, a leading law firm and their cybersecurity team. When you talk to the forensics experts, they will tell you the complications of trying to understand where these criminals were, the footprints they had left, the inquiries they had made. It is a cumbersome, cumbersome process. That's why it took weeks before we had an indication of the breadth and the depth of the issue, which brought us to the August 24th date that you mentioned.

B

Bob Latta30:55

Let's back up to July 31st. When you learned — again, you're talking with the experts at that time — you learned about the breach, and you testified that you did not know that personal information had been stolen at that point. But did you ask anyone if personal information had been stolen when you found out about that breach?

R

Richard Smith31:14

Congressman, on the 31st, all I was told at that time was that security had noticed a suspicious movement of data out of an environment we call a dispute portal. It was until later that they understood that was an actual dispute document. We had no indication on the 31st of July that there was any PII information that was vulnerable.

B

Bob Latta31:42

Okay, so I guess — but again, not knowing that that personal information had been stolen at that time, you know your company is built on data. At any point, did you think that was important, or did somebody in the company start looking at whether personal data had been stolen at that point?

R

Richard Smith32:00

Congressman, I can tell you we were working with the best forensic auditors in the business. They do this for a living. We had a great cyber team from King & Spalding with us. It took them time. At that time, they did not know if data had been compromised, exfiltrated, or what the data was.

B

Bob Latta32:20

If we go back to when you did find out about the breach in that conversation with your chief information officer, Mr. Webb, how exactly did he tell you that there'd been a breach? Was it a phone call, an email, in person? How did he notify you of the breach?

R

Richard Smith32:33

It was a face-to-face brief meeting on the 31st. At that time, he had just learned as well, so the day was very, very fresh to him. The incident was described as an incident, not as a breach.

B

Bob Latta32:49

Is that the normal way for that information? If there had been a breach at the company, to notify someone, is it standard operating procedure for the CIO to come and just give a face-to-face?

R

Richard Smith33:03

Congressman, at that time we had no indication it was a breach. It was a suspicious activity.

B

Bob Latta33:11

Did you tell anyone else in senior management or any other members of the board of directors about the breach at that time? Or is it just not until you told the lead director on August 22nd and then the 24th before the rest of the board of directors? Did anyone else know about the breach?

R

Richard Smith33:29

Again, it's important to say on July 31st, it was not — we did not know it was a breach at that time, just suspicious activity. The first notification to the board was the lead director on the 22nd of August, which followed in the chronology of events a meeting I had with our cybersecurity experts and our outside counsel that occurred on the 17th of August. That's when the picture was starting to develop.

B

Bob Latta33:56

Thank you. My time is expired. I'll recognize the gentlelady from Illinois, the ranking member, for five minutes.

J

Jan Schakowsky34:05

Thank you, Mr. Chairman. I'm going to get right to it. I wanted to ask some questions about John Kelly, the chief legal officer, who I understand is responsible for security at Equifax, or was at least at the time of the breach and its discovery. Is that right?

R

Richard Smith34:25

That is correct, Congresswoman. And Mr. Kelly in turn reports directly to you, the CEO. Correct?

J

Jan Schakowsky34:32

Right. Okay, so we were told that Mr. Kelly was informed by the chief security officer the week of July 30th — we've just been talking about that — that a cybersecurity incident had occurred. Is that correct?

R

Richard Smith34:44

He was notified, is my understanding, on the 31st of July that there was a suspicious activity in a particular environment called a web portal that was a dispute environment.

J

Jan Schakowsky34:57

We were told that Mr. Kelly — this is our staff — was informed at the same time that the incident might have compromised personally identifiable information. Is that correct?

R

Richard Smith35:10

The only knowledge I have is he was notified on the 31st that there was suspicious activity in a consumer dispute portal.

J

Jan Schakowsky35:18

Well, we were told that Mr. Kelly then wrote a short memo to you regarding the incident. Is that correct?

R

Richard Smith35:26

Correct, Congresswoman. In his email, it said some suspicious activity around that.

J

Jan Schakowsky35:37

At the same time, three Equifax executives sold over $1 million of Equifax stock. That's on August 1st and August 2nd. And it's reported that Mr. Kelly was ultimately responsible for approving those sales. Is it true that Mr. Kelly or one of his direct reports would have been required to sign off on these stock sales?

R

Richard Smith36:04

Yes. Mr. Kelly, who is our general counsel, owns the clearance process. And — I have a lot of questions, so the answer is yes, he had to, he was supposed to sign off. Yes.

J

Jan Schakowsky36:16

Did any one of these three executives have knowledge the cybersecurity incident had occurred?

R

Richard Smith36:24

To the best of my knowledge, Congresswoman, no.

J

Jan Schakowsky36:28

When were they informed that the incident had occurred?

R

Richard Smith36:34

I don't know exactly the date that they were informed. But to the best of my knowledge, they had no knowledge at the time they cleared their trades.

J

Jan Schakowsky36:41

The general counsel — do you know for sure that they didn't know?

R

Richard Smith36:44

To the best of my knowledge, they did not know.

J

Jan Schakowsky36:47

And Mr. Kelly, who we were told knew of the breach and that it contained personal information, and yet still approved the stock sale — is he still chief legal officer for Equifax?

R

Richard Smith37:01

Congresswoman, I would come back to it again. He did not know it was a breach when he approved it. It could have been a breach. All he knew at the time, to my understanding, was suspicious activity when he approved the sales.

J

Jan Schakowsky37:13

What the heck does 'suspicious' mean? It could be a breach, right? It was deemed a suspicious activity. We had no indication that PII was in fact compromised at that time. We had no idea if data was exfiltrated at that time. So now I understand that you agreed to forgo your 2017 bonus, which has been about $3 million for the past two years. Correct?

R

Richard Smith37:40

That is correct.

J

Jan Schakowsky37:42

But it's been reported that you will still retain $18 million in pension benefits from Equifax. Is that accurate?

R

Richard Smith37:49

That is correct. Retiring, which is the category right now, although the company maintains the right to change that designation. Also means you'll be free to sell your Equifax stock, which is worth about $24 million. Is that correct?

J

Jan Schakowsky38:05

Congresswoman, that calculation is hard to say. It's a complicated calculation. It depends on the total shareholder return of the company at the time the stocks vest. There are multiple variables. That may be an estimate. I've seen different estimates. It's hard to say what that number is. We won't know till the end of the year. And that's in addition to Equifax stock you sold earlier this year for $19 million. Is that correct?

R

Richard Smith38:29

That sounds correct.

J

Jan Schakowsky38:31

And according to one report, you could be eligible for $22 million in performance-based compensation, depending on how Equifax stock performs in the next three years. Is that right?

R

Richard Smith38:41

Maybe. Let me be very clear, Congresswoman. When I announced my retirement, I thought it was best for the company to move forward with a new leader. I agreed to step down at that time with no further compensation. I agreed I should not get a bonus. I agreed it would be no severance. I asked for nothing beyond what I'd already earned.

J

Jan Schakowsky39:03

I was just informed by staff that the chief security officer told the chief legal officer verbally that there was PII. That according to a call with staff yesterday, that actually there was a mention of the breach of personally identifiable information. The CSO told that — yeah, told us on a call yesterday is what I just heard from staff.

R

Richard Smith39:35

Congresswoman, I have no documentation, no insight, no knowledge that anyone in the company had informed me or, in that case, the chief security officer or the chief general counsel that there was a breach on July 31st.

J

Jan Schakowsky39:52

Is that what you said? Yes, no, we didn't say a date. I'm told that our staff didn't say a date. Okay. Let me just say I'm glad the FBI is looking into it. Many state attorneys general, the city of Chicago has sued, so we'll probably get more information that way as well. Thank you.

B

Bob Latta40:09

Thank you very much. The gentlelady's time has expired. The chair now recognizes the chairman of the full committee, the gentleman from Oregon, for five minutes.

G

Greg Walden40:16

Thank you, Mr. Chairman. Mr. Smith, thanks again for being here today. You know, this is a sample of a copy of an Equifax credit report in my hand. It lists Social Security numbers, address, credit history, debts — all the sort of personal financial information. It's the lifeblood of Equifax, right? I mean, these data points are really, really important to what you do as a company.

R

Richard Smith40:41

Congressman, that's correct. It's a $3 billion company, data on 820 million customers worldwide. And yet it appears this breach happened because the company didn't know it was running certain software on its system, right? The Apache Struts software that had the patch requirement.

G

Greg Walden41:02

Congressman, as I alluded to in my opening comments and in my written testimony, there was a human error and a technology error that did not allow us to identify — and I think that's what we're trying to get to here. If I understand it right, your own information technology system did not tell the Equifax security division that the Apache Struts software, which contained the vulnerability that led to this breach, was running on the Equifax system. How did that happen?

R

Richard Smith41:30

Congressman, the day after the notification came out from CERT, the security team notified a wide range of people in the technology team who were responsible for finding the patch, finding the vulnerability, applying the patch. And then days later, as is typical protocol, to deploy a technology scanner to then go look for the vulnerability, find the vulnerability. If it found a vulnerability, it knew it was not patched. Both the human deployment of the patch and the scanning deployment did not work. The protocol was followed.

G

Greg Walden42:14

Okay, so then people ask us: how does that happen? If you're as sophisticated a company as you headed, with so much at risk, how does this happen? And you know, we have colleagues that say we're in a double defense, triple defense, put mines in, do all these things. But how does this happen when so much is at stake? I don't think we can pass a law that — excuse me for saying this — but fix is stupid. I can't fix stupid, as a colleague of mine used to say. With so much at risk, I've talked to other software companies and people in this space who say some companies have an automated system that when a patch comes out, it automatically gets installed. That's not what you had, necessarily, right?

R

Richard Smith43:04

I'm unaware of an automatic patch system. What we have in place is security gets notification, and it's not uncommon to get notification from software providers routinely about vulnerabilities that are discovered. They followed the protocol, which is to notify the appropriate people within the time frame that the protocol called for. Unfortunately, the human error was they did not find the patch. No.

G

Greg Walden43:28

If I could — the human error, you reference, is that they didn't know that that particular software was running on your system? Apache Struts was running, that's what needed patching, right?

R

Richard Smith43:39

Congressman, great question. If I may clarify, please. The human error was that the individual who was responsible for communicating in the organization to apply the patch did not do so.

G

Greg Walden43:56

So does that mean that that individual knew that the software was there and it needed to be patched and did not communicate that to the team that does the patching? Is that the heart of the issue here?

R

Richard Smith44:08

That is my understanding, sir. And there's no — I was on a bank board for a while, and you know we always had sort of double checks on everybody, right? Do you not have a double check of some sort, an audit of some sort? It seems like that was a single point.

G

Greg Walden44:26

The double check was the scanning device that was deployed a few days later. But did the scanning device — I don't know how that process works. Does it know you have that software? Do you have to tell it what you're scanning for? It's the latter. You have to tell it what it's looking for. It scans the environment. So the individual who didn't tell the IT team — I'll call it the IT team, whatever — the security team, that's where the failure was. Was it the same person telling them what to look for?

R

Richard Smith44:53

No, the scanner is deployed by the security team. And I should clarify there that the rationale, the reason why the scanner, the technology piece, did not locate the right vulnerability is still under investigation by outside counsel.

C

Congressman45:04

All right, one final question. You've referenced this suspicious movements of data. You've referenced incident. American people who think all of that is breach. How regularly did you have incidents or suspicious movement of data? Is this a routine thing that people call, 'Hey, we had another incident, we got another suspicious movement of data,' or was this sort of outside normal?

R

Richard Smith45:30

Congressman, thank you for the operations. As you alluded to in your comments, we do have a lot of data and our primary goal is to protect that data. And we have experienced millions of suspicious activity against our database any given year. But to the point that the head of your security team comes to you and says, 'Hey, we've got another one' – oh yeah, that is not uncommon. It's not uncommon for us to engage forensic audit firms, it's not uncommon for us to engage outside counsel to help us think things through when there's suspicious activity. It's a part of doing business in an innovative business, as you alluded to. I thank you for the indulgence on the committee. I yield the balance of my time.

C

Chairman46:26

The gentleman yields back. And the chair recognizes the ranking member of the full committee, the gentleman from New Jersey, for five minutes.

F

Frank Pallone46:33

Thank you, Mr. Smith. You testified that on August 11th you were informed that hackers had stolen, quote, 'a large amount of consumers' personally identifiable information,' unquote, in this incident. And on August 17th, I guess a week later, you said in a speech, and I quote, 'Fraud is a huge opportunity for Equifax. It's a massive growing business for us,' unquote. So I'm just looking for a number, Mr. Smith. At the time you gave that speech, roughly how many consumers did you believe had been compromised by the breach? If you could –

R

Richard Smith47:06

Congressman, if I may clarify. Thank you. You alluded to August 11th date. August 11th initially, and then August 17th in the second speech. On August 11th, I had no indication. I was not informed at that time. My notification was before the August 17th meeting. And you alluded to a speech –

F

Frank Pallone47:23

Well, I'm just – yeah, I mean on the 17th you said in the speech, 'Fraud is a huge opportunity for Equifax. It's a massive growing business for us.' I'm just looking for a number. At the time, roughly how many consumers did you believe had been compromised by the breach on August 17th, which is, I think, on and around the date you had talked about that?

R

Richard Smith47:39

I gave a speech. We do not know how much data was compromised, what data was compromised. That story was still developing. And that speech that you're alluding to is a very common speech we have in communities. I think this happened to be at a university then. We talked to them. But at that time when I gave that speech, I did not know the size or the scope of the breach.

F

Frank Pallone48:06

All right. During your tenure at Equifax, you expanded the company's business into packaging and selling other people's data. And in that August 17th speech, you explained that having free data with a gross margin of profit of about 90 percent is, and I quote, 'a pretty unique model.' And I get that this unique model is a good deal for Equifax, but can you explain how it's a good deal for consumers?

R

Richard Smith48:31

Thank you, congressman. I think I understand the question. Our industry has been around for a number of years, as you know. In fact, Equifax is a 118-year-old company. We're part of a federally regulated ecosystem that enables consumers to get access to credit when they want access to credit, and hopefully the best rates available to them at that time. So we're very vital to the flow of economy, not just in the US but around the world.

F

Frank Pallone48:57

All right. Now I want to turn to what Equifax is offering consumers in the wake of this breach, specifically the free credit lock service that is supposed to be introduced next year. We've been told that this free credit lock service could require consumers to consent to Equifax sharing or selling the information it collects from them to third parties with whom the individual already has a business relationship for marketing or other purposes. Is that true?

R

Richard Smith49:23

This product will be a web-enabled, mobile-enabled application that will allow a consumer, at the time he or she decides they want access to credit, to simply toggle on, toggle off that application to give the bank, the credit card issuer, auto lender access to their credit file to approve their loan.

F

Frank Pallone49:45

Well, by agreeing to use the Equifax lock service, will consumers also be opting into any additional marketing arrangements, either via Equifax or any of its partners?

R

Richard Smith49:58

Congressman, we're trying to change the paradigm. What I mean by that is this will be in an environment viewed as a service, a utility, not a product. There'll be no cross-selling, upselling, or any products available to the consumer when they go to get and sign up for the lock product. It's a service to them, and that's the only product or service they'll get.

F

Frank Pallone50:18

Yeah, well, will Equifax give consumers an easy and free method to choose not to share their data in this way, even if the consumer already has a business relationship with the third party?

R

Richard Smith50:30

Yeah, congressman. I envision as this evolves over time, the consumer will have the ability to invite into their world who they want to have access and who they do not. It'll be their choice, their power, not ours to make that decision.

F

Frank Pallone50:44

Now, last week the interim CEO announced that by January 31st of 2018, Equifax would make locking and unlocking of a consumer's Equifax credit report free forever. A credit report lock is already included in TrustedID Premier and other services like credit monitoring and identity theft insurance. Well, that still ends after one year.

R

Richard Smith51:06

Congressman, a couple of differences. Number one, the product we offer today for consumers protects the consumer at the same level of protection they'd get January 31st. The difference is today a browser-enabled product or service; the 31st of January will be an application, much simpler and easier for the consumer to use. The protection is largely the same.

F

Frank Pallone51:34

So they get this free service. They sign up for one year. At the end of the one year, effective January 31st of 2018, he goes into the new lock product. I guess you know the difference, other than not expiring, between the credit report lock that is part of TrustedID Premier and the credit locking tool that will be available in January? Why not just extend the freeze program?

R

Richard Smith51:58

There's a difference between the freeze product, which came to pass with FACTA back in 2003, passed into law in 2004, that is now governed by state laws in all states. And it's a cumbersome process for a consumer. In many cases, some states require you to mail in your request for a freeze, and then we must mail you a PIN. So your ability to get access to credit when you want credit is encumbered. A consumer could go to a car dealer, to a bank to get a credit card, forget his or her PIN on a freeze product, has to go back home, look for the PIN, mail the PIN in. So it's a cumbersome process. The lock product we're offering today is a big step forward. The lock product for the 31st of January is an even further step forward.

F

Frank Pallone52:50

My time is right now, Mr. Chairman. Thank you very much.

C

Chairman52:51

The gentleman's time has expired. The chair now recognizes the chairman emeritus of the full committee, the gentleman from Texas, for five minutes.

C

Congressman52:57

I thank you, Mr. Chairman. And since I'm not a member of this subcommittee, thank you for your courtesy and allowing me to ask questions. Mr. Smith, what's the market value of Equifax? What's your company worth?

R

Richard Smith53:16

Yeah, congressman, last time I checked it's somewhere close to $13 billion.

C

Congressman53:20

$13 billion. I'm told by my staff that this current data breach was about 143 million people. Is that right?

R

Richard Smith53:33

We were informed yesterday from the company that is typical and friends had got it. There was some slight movement and the number is adjusted. Press release came out from the company last night. It's 145.5 million.

C

Congressman53:46

Well, okay. I appreciate your accuracy there. But under current law, you're basically required to alert each of those that their account has been hacked, but there's really no penalty unless there is some sort of a lawsuit filed and the Federal Trade Commission or a state attorney general files a class-action lawsuit against your company. So you're really only required to notify everybody and say, 'So sorry, so sad.' I understand that your company has to stay in business, has to make money, but it would seem to me that you might pay a little bit more attention to security if you had to pay everybody whose account got hacked a couple of thousand bucks or something. What would the industry reaction be to that if we passed a law that did that?

R

Richard Smith54:49

Congressman, I understand your question. I think the path that we were on when I was there and the company's continued is the right path. And that's the path of allowing the consumers to control the power of who and when accesses their credit file going forward.

C

Congressman55:07

Taking the consumer can't control the security of your system. That is true, sir. And you control security. People knew there was a problem, and according to staff briefings that I've been a part of, they didn't act in a very expeditious fashion until the system had already been hacked. And I mean, you're to be commended for being here. I don't think we subpoenaed you. I think you appeared voluntarily, which shows a commendable amount of integrity on your part. But I'm tired of almost every month there's another security breach. And it's okay, we have to alert you. I checked my file to see if I was one of the ones that got breached, and apparently I wasn't. I don't know how I escaped, but I didn't get breached. But my staff person did. And we looked at her reports last night. The amount of information that is collected is way beyond what you need to determine if she's creditworthy for a consumer loan. Her basically her entire adult history going back 10 years, everywhere she's lived, her name, date of birth, social security number, phone numbers, addresses, credit card, student loans, security clearance applications for federal employment, car insurance, even employment history of jobs that she worked when she was in high school. That's not needed to determine whether she's worthy of getting a $5,000 credit card or loan or something. And now it's all out in the nether world of whoever hacked it. You know, I can't speak for anybody but myself, but I think it's time at the federal level to put some teeth into this and some sort of a per account payment. And again, I don't want to drive credit bureaus out of business and all of that, but we're going to have this hearing every year from now on if we don't do something to change the current system. So I would hope that you'd go back to your peers and work with the committee, its chairman, and the subcommittee chairman and ranking member, and let's figure out something to do that actually gives an incentive to the industry to protect ourselves. And the only way I know to do it is to have some fine per account hacked that's large enough that even a company that's worth $13 billion would rather protect their data and probably not collect as much data than just come up here and have to appear and say we're sorry. With that, Mr. Chairman, thank you for your courtesy. I yield back.

C

Chairman58:08

The gentleman yields back. And the chair now recognizes the gentleman from New Mexico for five minutes.

B

Ben Ray Luján58:15

Thank you, Mr. Chairman. Mr. Smith, there is a difference between a lock product and a freeze, correct? Those are two different things.

R

Richard Smith58:24

Congressman, the process is a little different, but as far as the consumer and the protection that he or she would get from doing one versus the other is virtually, if not exactly, the same.

B

Ben Ray Luján58:39

Virtually almost exactly is not the same. It's this: are they different? It's the same. So your lock product is the same as a freeze as far as the protection? Well, getting to that later, right? Look, I appreciate that clarification. But will Equifax be willing to pay for this freeze, for this lock at Experian and TransUnion for consumers whose information was stolen through Equifax?

R

Richard Smith59:35

Congressman, the companies have come out with what they feel is a comprehensive set of different services. Today, a lifetime lock. I would encourage, to be clear, I would encourage TransUnion and Experian to do the same. It's time we changed the paradigm, give the power back to the consumer to control who accesses his or her credit data.

B

Ben Ray Luján59:57

It's okay. I mean, down to limited time. I apologize. I'll take that as a no, that Equifax will not pay for Experian and TransUnion consumers. Do you think consumers should have to pay a penalty for your mistake, including potential identity theft, false credit accounts, fraudulent tax returns, or medical identity theft? Or do you commit to compensating any consumers who suffer harm as a consequence of your breach?

R

Richard Smith1:00:19

We take this seriously. I've apologized again to the American consumer. We've offered a comprehensive set of products for free.

B

Ben Ray Luján1:00:27

Mr. Smith, will those comprehensive sets of products make consumers whole? Will they protect them going forward? Will they make them whole? Yes or no?

R

Richard Smith1:00:38

It's hard for me to tell if someone's been harmed, so I can't answer the question. If someone's credit has been stolen and someone opened up a bunch of their accounts, bought furniture, bought cellphones, bought a bunch of fuel, and now this consumer can't fix their history, they've been harmed. In that case, will Equifax make that person whole?

B

Ben Ray Luján1:00:57

Congressman, as I said, I apologize. We've offered them a comprehensive – thank you very much. So I want to go back to the line of questioning earlier from Mr. Pallone. On August 11th, in your prepared testimony, it says that you are aware of a large amount of consumer PII. On August 15th, it says in your prepared testimony PII had been stolen, it appeared likely, and that you requested a detailed briefing to determine how the company should proceed. On August 17th, it says you held a senior leadership meeting to receive the detailed briefing on the investigation. You gave a speech also on the 17th about profiting off of fraud with these new markets. You shared with Mr. Pallone that you were not aware of PII being stolen. What is it?

R

Richard Smith1:01:39

Congressman, on the 17th I had a full debrief from Mandiant, our forensic auditors, and outside counsel and my team. I was aware on the 15th that there had been some PII compromised. How much, the scope –

B

Ben Ray Luján1:01:54

I appreciate that clarification. You were aware it was stolen, you just were not aware how much.

R

Richard Smith1:01:58

I was not aware it was stolen. It was –

B

Ben Ray Luján1:02:02

You just – it says in your prepared testimony that you were aware that you asked for a detailed briefing to determine how the company should proceed. So you were aware that PII was stolen on the 15th. Is that true or not true?

R

Richard Smith1:02:13

At that time, the 17th was the detailed review of when I learned about PII. And even at that time, which PII was it stolen? Was it not stolen? Those details came to life, congressman, over the course of August.

B

Ben Ray Luján1:02:27

Mr. Smith, on August 15th, were you aware that there was PII that was stolen or not? On August 15th, regardless of the amount, were you aware of that?

R

Richard Smith1:02:41

August 15th, I was made aware that hackers, criminal hackers, had gotten into our system. It had some PII information.

B

Ben Ray Luján1:02:48

Well, we can revert to your prepared testimony. The other question that I have that Ms. Schakowsky was asking on is: chief legal officer John Kelly, still employed by you or by Equifax?

R

Richard Smith1:03:01

Yes, he is.

B

Ben Ray Luján1:03:03

And you were the CEO at the time that approved the terms of the retirement for David Webb and Susan Maldini? Is there a classification as retired permanent, or could it potentially change to fired for cause like yours? There's an investigation going on by the board at this time. And Mr. Chairman, I know that my time has collapsed, if you will. But there's an article in WGN-TV that talks about Equifax doing their own investigation into the three executives that sold their stock and profited. And I just, I guess they must have a pretty good investigative team there because between the press release that happened on Friday or whatever it came out and then a story on Sunday and today we have a revelation that those folks didn't know that this breach took place. I just hope we get to the bottom of this. And again, Mr. Chairman, I hope that we can be given assurance to the committee and to the American people that this committee will have a markup and a hearing with bills that we can take to the floor before the holidays to give the American people, consumers, confidence again because this is a mess. Thank you, Mr. Chairman. Thank you very much.

C

Chairman1:04:13

The gentleman's time has expired. The chair now recognizes the gentleman from Mississippi, the vice chairman of the subcommittee, for five minutes.

C

Congressman1:04:22

Thank you, Mr. Chairman. Mr. Smith, thank you for being here to testify today. In your written testimony, in response to some of the Chairman's questions, you stated that you were informed of suspicious activity on July the 31st by your chief information officer. And went on to discuss that. And you said, 'I certainly did not know that personally identifiable information PII had been stolen or have any indication of the attack.' Did you ask him if there had been any personal identifying information that had been obtained?

R

Richard Smith1:04:57

Congressman, at that time I was informed it was a dispute portal document. Dispute portal document is something that typically houses, if the consumer is disputing with us, they paid off a utility bill, he or she may take a picture of utility bills. So that was a conversation –

C

Congressman1:05:16

Not to interrupt, but my question was: did you ask if any PII had been accessed?

R

Richard Smith1:05:21

No, I did not.

C

Congressman1:05:24

Were you made aware at that point of the Apache Struts patch?

R

Richard Smith1:05:26

No, sir, I was not.

C

Congressman1:05:31

Had you had any meetings with your chief information officer or your security department about any of this issue prior to July 31st?

R

Richard Smith1:05:39

No, congressman, I did not.

C

Congressman1:05:43

Had you had any meetings with him about any other security information during that time from March until July 31st?

R

Richard Smith1:05:50

Oh, yes. We would have routine meetings, security reviews, IT reviews.

C

Congressman1:05:56

How often do you have those?

R

Richard Smith1:05:58

Common due process would be at least quarterly.

C

Congressman1:05:59

And why did you not have this discussion come up? And did you have – obviously that's more than a quarter, so how many meetings did you have between that time of March the 8th until July the 31st with your security team? Make sure I understand your question.

R

Richard Smith1:06:12

Why didn't – how many meetings did you have during that time from March the 8th until July the 31st? I don't have that information with me. If that's important, we can get that.

C

Congressman1:06:23

Well, how many do you remember? Do you remember any of those?

R

Richard Smith1:06:25

So it normally would have IT reviews at least quarterly and security reviews at least quarterly, and then you'd augment that on an as-needed basis.

C

Congressman1:06:37

Well, with those meetings in those timelines of March the 8th into July 31st, we are covering two, three quarters, not a total of nine months, but you touch into three quarters of that year. And at any point in any of that, did you have any information about this going on?

R

Richard Smith1:06:52

No, sir, I did not.

C

Congressman1:06:56

All right. In your testimony, you indicate that the security department ran scans in March for the vulnerability but failed to identify it. Can you explain how this is possible? And why was there never any confirmation of anybody coming back and checking to see, okay, we have this identified information? There was a failure of someone on the team to identify that this was being used, that the software was even being used. Was there no one coming in to verify? Did you have any outside person prior to the ones that you hired to look at this?

R

Richard Smith1:07:27

All right, congressman. We get notifications routinely. The IT team and security team do apply applications. This individual, as I mentioned earlier, did not communicate to the right level to apply the patch.

C

Congressman1:07:42

Follow-up: was this – as you mentioned, you said 'this individual.' So you had one person responsible for this?

R

Richard Smith1:07:47

There's an owner of the patch process. There's a communication that comes out from security. It's a broad-based communication once they receive notification from a software company, in this case DHS. They notify appropriate people, and an individual who owns the patch process cascades that communication for everyone that's on your Equifax team.

C

Congressman1:08:09

Is there anything more important than protecting the PII of your consumers?

R

Richard Smith1:08:14

No, sir.

C

Congressman1:08:18

With that, would we identify that as the number one responsibility of the company and everybody in your company?

R

Richard Smith1:08:22

We have four here, sir. Yes.

C

Congressman1:08:25

So it just appears, obviously, I mean the job wasn't done. And so we know that. And we're trying to look at this. And I know there was an Equifax spokeswoman who said, 'We've taken short-term remediation steps and continued to implement and accelerate long-term security improvements as part of ongoing actions to help prevent this type of incident from happening again.' So we have 145.5 million people whose PII has been compromised. How many files do you have in the system?

R

Richard Smith1:08:57

Worldwide? Yes, sir. I think someone mentioned earlier there's a public number out there: over 800 million consumers and 100 million companies roughly. And we know this breach includes some from Canada, something from the UK. Would that be fair to say?

C

Congressman1:09:16

At this point, congressman, a point of clarification. There was some data that we had on 7,000 Canadians in the US, so the data was in the US same environment. We had some data on UK citizens also in the US. That piece is still under investigation.

R

Richard Smith1:09:35

You know, my home state of Mississippi has 3 million people. 3 million people. Almost 1.4 million files have been breached. And in my state, if you take away people that are minors who don't have a file yet, almost my entire state is going to be impacted. So this is a travesty, something that was preventable, we know. And so saying that we want to protect what goes forward doesn't bring us a lot of comfort today. Thank you. I yield back.

C

Chairman1:10:06

The gentleman yields back. The chair now recognizes the gentleman from California for five minutes.

C

Congressman1:10:15

Thank you very much. I thought I'd prepared for this committee, but I have more chicken scratch notes. I don't know where to start. Mr. Smith, welcome to Washington. Are you currently employed by Equifax?

R

Richard Smith1:10:33

No, sir.

C

Congressman1:10:40

You are not. When you decided to come before this committee, were you specifically requested by name to come to this committee by this committee, or were you offered up by Equifax as the representative of Equifax to come represent Equifax before this committee?

R

Richard Smith1:10:54

I believe I was asked specifically to come before the committee by Equifax or the committee. My understanding is by the committee.

C

Congressman1:11:06

Okay. Apparently the committee asked for the CEO at the time, and at that time you were still the CEO, but you're no longer the CEO. Did you inquire as to why the current CEO or interim CEO didn't come before this committee?

R

Richard Smith1:11:20

I did not. But I felt personally it was my obligation. The breach occurred under my watch, and as I said in my written testimony and my oral testimony, I ultimately take that responsibility. So I thought it was important that I be here.

C

Congressman1:11:36

Okay, thank you. I get the picture. On August 31st – or excuse me, on July 31st you were notified of the suspicious activity. It eventually, as we now know, is a 145.5 million person breach. Was it July 31st?

R

Richard Smith1:11:51

Yes, congressman. It was a brief interaction, a verbal interaction with – yes.

C

Congressman1:11:57

You just referenced as an answer to another one of my colleagues' questions. On that, on August 31st you received some kind of email referring to the possible breach?

R

Richard Smith1:12:06

Point of clarification. I was notified on the 31st of July by the chief information officer, Dave Webb, in a very brief interaction that this portal seemed to have a suspicious incident. There was a communication trail internally between others that also referenced that I was aware of this incident through my interaction with Dave Webb. So that trail was not directed to you; you were just mentioned in that trail that you had been verbally notified. That's my recollection.

C

Congressman1:12:41

Okay. Mr. Chairman, is it appropriate for this committee to ask for that trail of documents? Well, that's the – or counsel that I'd say. Okay, well if it's appropriate, Mr. Chairman, what I would like is for my office and this committee to receive copies of that trail that it's been referenced more than once to some of our questions here on this committee, on this congressional committee. It's come to my attention that several people are no longer with the corporation. You're not officially with the corporation anymore. The CIO at that time is no longer the CIO of the corporation of Equifax.

R

Richard Smith1:13:25

That is correct.

C

Congressman1:13:28

And then there's another higher up that is no longer the chief security officer.

R

Richard Smith1:13:33

Chief security officer.

C

Congressman1:13:35

However, the then John Kelly, chief legal officer, was the chief legal officer at that time but still is currently the chief legal officer. Correct?

R

Richard Smith1:13:42

That is correct.

C

Congressman1:13:44

Okay. Apparently the chief legal officer, about between July 29th and August 1st, went to outside counsel and hired outside counsel. Who? Correct?

R

Richard Smith1:14:02

No, congressman. What occurred on August 2nd is that the chief security officer reached out to forensic expert, cyber expert, and outside counsel King & Spalding, and she engaged them at that time.

C

Congressman1:14:21

Okay, thank you. When executives at Equifax want to sell stock, they need to get the chief legal officer to sign off. Yes?

R

Richard Smith1:14:36

Correct, congressman. There's a protocol that requires the general counsel of Equifax to approve that sale.

C

Congressman1:14:43

Okay. And John Gamble, Joseph Loughran, Rodolfo Ploder – they're all high ups with Equifax. They apparently sold stock on or about August 1st or 2nd in the amount of approximately $1.8 million, give or take. So they had to get an OK from John Kelly before they did that. Correct?

R

Richard Smith1:15:02

That is correct, sir.

C

Congressman1:15:05

Okay. And apparently they did get the okay.

R

Richard Smith1:15:07

Yes, that's my understanding.

C

Congressman1:15:09

And you were the CEO at the time that they sold that stock. And I have no – steps range on – but you were the CEO at the time. Thank you, mister. I'm just a little – latitude on my time, just a little bit, please. What I would like to request of you, Mr. Chairman, and also the ranking member Schakowsky, that we ask for a specific hearing of this committee where we get John Kelly, chief legal officer, who was then the chief legal officer of Equifax and is currently still the chief legal officer. Hopefully when we, when and if we get him here, he will still have that title. I'm a bit disturbed that we are the Congress holding a hearing and that Equifax has before us someone who no longer works for them. Thank you very much, Mr. Chairman. I hope that we can ask for that hearing where we get John Kelly, the chief legal officer, before. Thank you very much.

C

Chairman1:16:01

Gentleman's time has expired. The chair now recognizes the former chair of the full committee, the gentleman from Michigan, for five minutes.

C

Congressman1:16:07

Well, thank you, Mr. Chairman. Mr. Smith, every family watches over their financial data with great concern. It impacts their daily life, whether it's going to get a mortgage, a loan, a car. They have to have that credit score that gets in often even a job. So they view that data as it relates to them as very, very private, and they want it to be secure. Here is an Equifax credit report for somebody that I know. It's 131 pages long. Unbelievable in terms of the data that has been collected on this particular individual. I would guess that most individuals have no clue that there's that much data that's been assembled on their own personal family account. Now you said earlier that the data was compromised. So a question that I have to ask is: does that word 'compromise' include the word or the term 'manipulated'? Are those folks who broke into that account able to actually change the accurate data that might be reflective of their own personal story? Could that be changed?

R

Richard Smith1:17:36

Congressman, I understand your question. The database was attacked by criminals, that we know. The forensic experts that we engaged in this case, Mandiant, has led us to believe that there's no indication the data that was left behind has been manipulated.

C

Congressman1:17:54

Now, one of the things that's in this report, any credit report, is you verify the income of that individual to make sure that it's accurate. And as I understand it, and I go again personal experience, when one goes to get a loan, whether it's a mortgage or a car, often one of those little boxes that you check is that you are allowing permission to look at that tax return of the individuals. That's not correct? Regardless of – I was self-employed income. Regardless, have automated underwriting findings. When self-employed income is used to qualify, the following documentation is required: most recent two years of their individual federal tax returns with all schedules and W-2s and K-1s, most recent two years business returns, IRS forms 1120, 1120S, 1065 in which the borrower has ownership interest at 25 percent or more, and a complete and signed IRS Form 4506-T is required for every borrower on the loan application. Tax transcripts validated from the IRS are required for each year documented in the loan file. So the question is: if that is collected, is someone, a bad actor, actually able to use the personal information stolen from this report to then perhaps file a false tax return come the first of the year?

R

Richard Smith1:19:37

Congressman, thanks. I think I understand your question. A couple points of clarification. Credit report does not contain employment and income information. There are many lenders will ask you as a consumer, 'I'm going to get a loan, validate your income,' and there are many means, as you alluded to in your readings, as to how you might do that. But the credit report does not contain employment and income data. Number two, the unfortunate criminal hack that we refer to this morning in written testimony and press release over the past month or so, it was clear to say it did not include that credit report information that you just picked up there. It was limited, nonetheless the largest number, but limited to an environment we call a consumer dispute portal, not the credit file itself.

C

Congressman1:20:30

Last question I have is: how did you know? I mean, how – we've had a lot of hearings, a number of them classified, breaches made into Department of Energy, utilities, a whole number of different major, major players where hackers are coming in trying to break and penetrate daily. What tripped these guys up? What was the – how did you identify that in fact a breach had been made? What was their mistake?

R

Richard Smith1:21:13

Congressman, there's a piece of technology called a decrypter. And there was a decrypter that allowed us to see some of the data. All right, and once we saw the data, that's the start of the conversation earlier in the testimony here. That's we saw the suspicious data and we were able to shut off the portal at the end of July.

C

Congressman1:21:36

You'll back. My time's expired. Thank you very much.

C

Chairman1:21:39

The gentleman yields back. And the chair now recognizes the gentlelady from Michigan for five minutes.

C

Congresswoman1:21:48

Thank you, Mr. Chairman. Mr. Smith, I first want to say we appreciate your coming and testifying today. We spent a lot of time talking today about the what, the when, the where, and the whys of this breach. And I agree with all of my colleagues that we need to be expressing extreme displeasure. But I want to ask a few questions about where we go from here, because I hope this has awoken the American consciousness about privacy and credit that they need to be paying far more attention to. This breach is different than most. Not only the scale of those affected, but the type of information taken. In the past, folks usually just changed your passwords, maybe you got a new credit card, and that was it. You know, it was an annoyance but it had no real impact on your life. That's not so simple when it's your social security number or other personal information. You can't change your social security number, and I can't change my mother's maiden name. This data is out there forever. Clearly something needs to be done. We can all sit here and talk about what went wrong, but we are doing the public a disservice to not at least begin the discussion on how to improve data security. That's why I am a proud co-sponsor of Representative Schakowsky and Ranking Member Pallone's bill. It's a good first step that needs to be given serious consideration. And I am also introducing the Data Protection Act of 2017. Whatever path we choose going forward, it's important that we take action on this topic and that all American consumers pay attention. Now I'd like to ask a few questions nobody's asked this question yet. So just a quick yes or no: have you or anyone on your team seen signs that the attackers were backed by a nation state?

R

Richard Smith1:23:44

Congresswoman, we've engaged the FBI at this point. That's all I'll say.

C

Congresswoman1:23:50

I don't think it's all the same, but thank you. After your security department blocked the suspicious traffic you mentioned in your testimony, did anyone from your team or outside companies venture beyond the perimeter of your network to attempt to locate where they came from?

R

Richard Smith1:24:10

Congresswoman, yes. Yes, we have the ability to track the IP address of the criminals. But as you know, finding a location where the IP address does not necessarily tell you where they're from. It's easy to set up IP addresses anywhere in the world.

C

Congresswoman1:24:25

I think we all care about this, but I want to move to this other topic. I share your belief that placing control of access to consumers' credit data should be placed in the hands of the consumer. But most people have no idea that Equifax was even holding their data. I unfortunately learned a long time ago because this isn't the first identity theft. And Doris and I both were part of something else where they got our Social Security numbers and mother's maiden names. It's one thing to take steps to mitigate damages after a breach has occurred, but going forward we must give consumers the chance to protect themselves before a breach happens. Do you believe that consumers can take reasonable steps to secure their identity and information if they don't even know who has it?

R

Richard Smith1:25:17

Congresswoman, I think we can help. I think we could help by the announcement of this offering to all Americans: they can lock and unlock your credit file for life for free. There needs to be a greater awareness. I understand your point clearly, and I think by making this available to all Americans is one step in doing that.

C

Congresswoman1:25:37

So I was just actually even educating my colleagues up here about Credit Karma, and they were stunned by how easy it was with two little factoids to suddenly unleash the amount of money they had in every one of the credit card companies, what any data inquiries have been in all of the different factors. I have a couple and I think most people don't understand that it's not just you but Experian and TransUnion who are also collecting this data. Why do consumers have to pay you to access their credit report? Why should that data not be free?

R

Richard Smith1:26:19

Congresswoman, the consumer has the ability to access a credit report for free from each of the three credit reporting agencies once a year. And you combine that with the ability to lock your credit file for life for free, again as a step forward.

C

Congresswoman1:26:36

Well, I'm running out of time. But like my colleague over here, if when you find mistakes, which a number of us have and we're luckier than 99.9%, it's very difficult to fix. And when you do fix it, you still have to pay. I think we need a longer debate about who owns this data and how we educate the American people. Thank you, Mr. Chairman. Thank you very much.

C

Chairman1:26:58

The gentlelady's time has expired. And the chair now recognizes the gentleman from New Jersey for five minutes.

C

Congressman1:27:07

Thank you, Mr. Chairman. Good morning to you, Mr. Smith. Criminals perpetrated this fraud. Is it possible that these criminals are from another country?

R

Richard Smith1:27:15

Congressman, it's possible. But at this time, it's possible.

C

Congressman1:27:21

Number two: is it possible it's the government of another country?

R

Richard Smith1:27:23

As I mentioned to the congresswoman a few minutes ago, we've engaged the FBI. They'll make that conclusion.

C

Congressman1:27:28

Though do you have any suspicions in that regard, either persons from other countries or the government of another country?

R

Richard Smith1:27:37

Congressman, at this time I will defer. We have the FBI involved.

C

Congressman1:27:43

Yes, I know we have the FBI involved. Do you have an opinion to the two questions I've just asked?

R

Richard Smith1:27:47

I have no opinion.

C

Congressman1:27:50

You have no opinion. The stock that was sold by your colleagues, Mr. Gamble, Mr. Loughran, I hope I'm pronouncing that right, Mr. Ploder, as I understand that stock was sold on August 2nd. Is it usual that executives of a mature company, not a company that has just come onto an exchange, is it usual that significant amounts of stock are sold?

R

Richard Smith1:28:14

Congressman, a few points of clarification. The stock was sold on the 1st and the 2nd. So I said the 2nd, the 1st was I think the first date it was sold. Yes, it's not unusual for stock to be sold at the end of a quarter after we have our earnings call. The window opens up. We encourage those who are going to sell to sell early in the window. The window is open for about 30 days to sell as early in the window as possible. And that's what occurred here.

C

Congressman1:28:40

You believe that this stock was sold merely as a matter of course, as would be true in any other quarter? Yes? You do not believe it was based upon knowledge known by these gentlemen related to the breach?

R

Richard Smith1:28:53

Congressman, I've known these individuals for some of them up to 12 years. They are honorable men. They are men with integrity. They follow due process. They went through the clearance process through the General Counsel. I have no indication that they had any knowledge of the breach at the time they made the sale.

C

Congressman1:29:09

Did you have knowledge of the breach at that time?

R

Richard Smith1:29:11

I did not, sir.

C

Congressman1:29:14

Weren't you warned well in advance of this that there was suspicious activity?

R

Richard Smith1:29:20

I was notified on July 31st in a conversation with the chief information officer that there was suspicious activity detected in a thing called, in an environment called the web portal, the consumer dispute. That was no indication of a breach. That was prior to the sale of the stock. Is that accurate? 31st of July, there was no indication of a breach at that time from my perspective.

C

Congressman1:29:41

As a layman, the difference between a breach and suspicious activity is not one that I believe is particularly relevant. A breach might have technical connotations to it, but certainly you were aware of untoward activity prior to that date. Is that accurate?

R

Richard Smith1:30:02

No, congressman, it is not. On the 31st, we had no indication the documents were taken out of the system, what information was included. It was very early days. It took the forensic experts, as I mentioned earlier, from then until the 24th to start to develop a clear picture. And that picture still changed. The 24th, those we heard just last night with the additional announcement.

C

Congressman1:30:27

Many calls have been received by Equifax at your call center since September 7th. Do you know how many calls have been dropped or missed due to staffing shortages or other issues?

R

Richard Smith1:30:42

Congressman, I don't have the exact number, but as I said in my opening testimony, I apologize. So let's start up –

It was overwhelming in volume, overwhelming. I think I mentioned over 400 million US consumers coming to a website in three weeks. We went live in a very short period of time with call centers. Our two larger call centers were taken down in the first few days by Hurricane Irma. The team is committed and was committed to make the experience better for the consumer, and I'm told that each and every day that the process is getting better.

C

Congressman1:31:14

On August 22nd you notified a lead director, Mr. Fiedler I hope I'm pronouncing that right, of the data breach, and the full board was informed later, I believe two days later. Why was there nearly a week between August 17th and August 22nd before members of the board were alerted?

R

Richard Smith1:31:38

Congress, when the picture was very fluid, we're learning new pieces of information each and every day.

C

Congressman1:31:43

What does that mean?

R

Richard Smith1:31:44

We're learning new pieces of information each and every day. As soon as we thought we had information that was of value to the board, I reached out to the lead director, as you said, Mark Fiedler, on the 22nd, convened a board meeting on the 24th, had a second board meeting on the 25th. I had subsequent board meetings routinely, if not daily, in many cases, through as recently as last week.

C

Congressman1:32:06

Thank you, my time has expired, Mr. Chairman.

G

Greg Walden1:32:08

Thank you very much. The gentleman's time has expired. The chair now recognizes the gentlelady from California for five minutes.

C

Congresswoman1:32:16

Thank you, Mr. Chairman, and thank you, Mr. Smith, for appearing here today. As many of my colleagues highlighted, the events that led to this data breach and the actions that Equifax management took after the fact are very upsetting. It seems that many Americans are in a place of breach fatigue, but this latest event that potentially impacts nearly half of all Americans should light a fire under every single member here, and I think you've noticed that it has lit a fire. We cannot follow the same script after the next inevitable data breach. That's one of the reasons why I'm also supporting Congresswoman Schakowsky's Secure and Protect Americans' Data Act. And it's not as if this type of legislation is unprecedented; forty-eight states have implemented laws that require consumers to be notified of security breaches, and I'm pleased that my home state of California was the first state to pass this kind of notification law in 2002. Today, if California residents' personal data is hacked, state law requires that they're notified in the most expedient time possible and without unreasonable delay. We must act to ensure that all Americans are subject to protections like this at the federal level. Mr. Smith, because Equifax without doubt has the information of many California residents, the company is subject to the California data breach notification law. Can you please describe to me how Equifax complied with the state law? Were California residents notified of the breach as required?

R

Richard Smith1:33:49

Congresswoman, I don't have the specific knowledge of the California law. I can tell you though that we worked as a team, including with our counsel, to help us show what we were doing was right for the consumer in the most expedient manner as possible. So we're aware of the requirements of the different state laws, I just don't have the specific knowledge as it relates to the state of California.

C

Congresswoman1:34:14

So you also don't know because the law also requires Equifax to submit a copy of the breach notification to the California Attorney General. You don't know whether this was done?

R

Richard Smith1:34:26

Congresswoman, I do not, but we can have our team follow up with your staff if that would be helpful.

C

Congresswoman1:34:30

Okay. In the context of this breach, if data that you hold is about me, do I own it? So all my data... Could you please repeat the question? If in the context of this breach, if the data that you hold is about me, do I own it?

R

Richard Smith1:34:52

Congresswoman, we are part of a federally regulated ecosystem that's been around for a long time, and it's there to help consumers get access, with their consent, to credit when they want access to credit.

C

Congresswoman1:35:11

Well, can you explain what makes data about me mine compared to what makes it someone else's?

R

Richard Smith1:35:21

The intent, if you will, of the solution we have recommended, we implement and are going live with in January of 2018, is in fact to give you as the consumer, through this lock product for life for free, the ability to control who accesses your personal information and who does not.

C

Congresswoman1:35:38

So at that point, you believe that I own, I can say I own my data, is that right?

R

Richard Smith1:35:43

You'll have the ability to control who accesses and when they access your data.

C

Congresswoman1:35:50

Okay. Could I ask you some further questions along what others have asked about credit locks and credit freezes? Now, limiting access to credit even for a short amount of time can have real financial consequences, especially for low-income populations. How quickly will I be able to be locked and unlocked, and how will you ensure that speed?

R

Richard Smith1:36:16

Congresswoman, thank you for that question. That is a great advantage of the product that we're offering for free versus the freeze, which again came about in 2004 at a regulation, and there are states that dictate how quickly you can get access to freezing and unfreezing your file. Oftentimes that can take days if not weeks because we're mailing data back and forth to the consumer. In this case, the antenna is in January 2018 on your iPhone, you can freeze and unfreeze your file instantly at the point you want it frozen or unlocked.

C

Congresswoman1:36:56

So, and I recall that one of my colleagues asked whether our credit lock was the same thing as a credit freeze, and you said it was, as far as protection to the consumer.

R

Richard Smith1:37:04

Congresswoman, it is as far as the ability to lock or unlock and freeze or unfreeze, the lock is far more user-friendly.

C

Congresswoman1:37:16

Okay, so you currently offer a credit lock product now, and you plan to offer this other one for free starting in January. And can you describe for me why you consider that a lock would be more economical for you, or would a freeze be? I'm trying to get the sense of the difference because I think there is a difference here.

R

Richard Smith1:37:46

Yes, if I may one more time to try to clarify. As far as protection, they are the same. The lock that we offered the consumers on September 7th gives you the same level of security you'd get from a freeze or from the product that's going out in January. The difference is today's lock is browser enabled, January's lock will be an app on iPhone, and secondly it will be instant on and off versus the freeze.

C

Congresswoman1:38:19

I've got more questions but I've run out of time. Thank you.

G

Greg Walden1:38:23

The gentleman from Illinois is recognized for five minutes.

C

Congressman from Illinois1:38:27

Thank you, Mr. Chairman, and sir, thank you for being here today. This is obviously a huge issue. 145.5 million people affected by this data breach, it's nearly half of all Americans. That's a failure on multiple levels: failure to keep consumer personal information secure, failure to appropriately respond to a breach, and failure to notify the public. My constituents and the American people need not just answers but they want assurances that they're not going to be financially ruined by this. I do want to make a quick point. Mr. Luján asked you if the people that would be harmed by this would be made whole, and you made a statement — and I understand there's probably some legal and technical reasons for this — but you said, 'I don't know if consumers are harmed.' I just want to make the point that I think the idea that people are not harmed is ludicrous. Of course they're going to be harmed. Even if there's no financial harm that comes to them, just even having this information exposed is a massive deal. But I fear that we're going to see bigger repercussions from that. But let me say now, Mr. Smith, I was surprised to find out that Equifax initially included a requirement that consumers consent to a mandatory arbitration clause. Why did that happen? Why was that at the beginning part of the rollout?

R

Richard Smith1:39:46

Congressman, thank you for that question. I want to clarify, the product offering that went live on the service on the 7th, it was never intended to have that arbitration clause apply to this breach. It was a standard boilerplate clause as part of a product. As soon as we learned that that boilerplate term was applied to this free service, I think within 24 hours we removed that and tried to clarify that that was a mistake. And one of the mistakes I alluded to in my oral testimony regarding the remediation product on September 7th.

C

Congressman from Illinois1:40:17

So does Equifax require consumers to consent to arbitration with respect to any of its other products, and if not, is that information prominently disclosed to the consumer?

R

Richard Smith1:40:30

Not as it relates to the breach, Congressman.

C

Congressman from Illinois1:40:33

Well, the question is what about any other products? Do you require consent to arbitration?

R

Richard Smith1:40:38

Some of the consumer products we have, there's an arbitration clause in there. It's a standard clause.

C

Congressman from Illinois1:40:43

What's the reason for that?

R

Richard Smith1:40:46

I don't have that answer. That's a standard clause. Hopefully you can get that to me, that'd be good.

C

Congressman from Illinois1:40:49

Your press release indicates that the company found no evidence of unauthorized activity on Equifax's core consumer or commercial credit reporting databases. What are Equifax's core consumer and commercial credit reporting databases, and how are they distinct from the databases containing personal information that was subject to the unauthorized theft?

R

Richard Smith1:41:08

Congressman, the area that was impacted here was a consumer dispute portal where consumers come in and dispute activity with us. That is separate from the core credit data that consumers have in our database.

C

Congressman from Illinois1:41:32

So in essence, were there 145.5 million people that at one point had disputed credit issues, then? If that was the portal they used, they could have been in that portal for multiple reasons. And we also, by regulation, have to keep data for extended periods of time, in some cases seven plus years. So it's a lot of data for a lot of years, but it's outside of the core credit file itself. Which company, I guess, kind of went into this? Which company databases were accessed? And why wouldn't you consider that, maybe now after this, to be part of the core consumer and commercial credit reporting databases?

R

Richard Smith1:42:12

It's just the way we define it. The credit file itself is housed and managed in a completely separate environment from a database that consumers would come into directly. The core credit file itself is largely accessed by corporations, companies that we deal with, versus consumers.

C

Congressman from Illinois1:42:31

Okay, so I just want to make sure. I'm not an IT expert, so to get 145 million people's records in only the dispute database, I guess I'm trying to figure out if you didn't really answer the question. Were there 145 million people that have disputed at some point in time, half of Americans, or was there another entry somehow through that that went into other information? Maybe I just don't understand the IT part of this.

R

Richard Smith1:43:00

The only entry was through the consumer dispute portal, and that is a completely separate environment from the credit file itself. We also, as you might recall, have a lot of data for small businesses in America in that environment, which is part of the definition that you were alluding to, was not compromised either.

C

Congressman from Illinois1:43:20

Okay, and lastly, are your core consumer or commercial credit reporting databases encrypted?

R

Richard Smith1:43:25

We use many techniques to protect data: encryption at rest, tokenization, masking, encryption in motion. To be very specific, this data was not encrypted at rest.

C

Congressman from Illinois1:43:40

Okay, so this was, but your core—is it some not all? Some data is encrypted, some tokenized, some in motion, some masked. There's varying levels of security techniques that the team deploys in different environments around the business. Okay, thank you, sir. I yield back.

G

Greg Walden1:43:56

Thank you very much. The gentleman yields back. The chair now recognizes the gentleman from California for five minutes.

C

Congressman from California1:44:02

Thank you, Mr. Chairman. Mr. Smith, it's my understanding that the compromised information was due to an unpatched vulnerability in the web application framework Apache Struts. Besides the company's online consumer dispute resolution portal, does Equifax have any other portals that use Apache Struts?

R

Richard Smith1:44:30

No, sir. This was the environment that had deployed Struts.

C

Congressman from California1:44:35

All right, that was a simple answer. You might need to restart my time. In addition to Equifax's credit monitoring and reporting services, the company has Equifax for Business offerings and in this capacity operates as a data broker. As a part of these services, the company collects large amounts of data about consumers without consumers having any knowledge of this happening. Was this information compromised in the breach?

R

Richard Smith1:45:04

I think I understand your question, but could you repeat that one more time, please?

C

Congressman from California1:45:09

Well, you're familiar with the Equifax for Business offerings?

R

Richard Smith1:45:15

Yes, we do have product offerings and solutions for small businesses, medium-sized businesses, and large businesses across the country.

C

Congressman from California1:45:21

Right. Was information from Equifax for Business also compromised in the breach?

R

Richard Smith1:45:28

No, Congressman, it was not, because back to the question earlier, that's part of what we call our core credit data. It was not compromised.

C

Congressman from California1:45:35

Well, and your testimony noted, 'Throughout my tenure as CEO of Equifax, we took data security and privacy extremely seriously and devoted substantial resources to it.' Could you tell us about what investments Equifax made in cybersecurity during your tenure?

R

Richard Smith1:45:52

Yes, Congressman. When I came to the company twelve years ago, we had virtually no focus on cybersecurity. At that time, cybersecurity was not as sophisticated as it is today. We've gone from that environment to a team now of over 225 professionals focusing each and every day on security around the world.

C

Congressman from California1:46:14

So what time frame is that?

R

Richard Smith1:46:15

That was the time I started, twelve years ago.

C

Congressman from California1:46:19

So you say that you hired up to 250 personnel, I believe, as well?

R

Richard Smith1:46:25

I didn't, the team did. I didn't hire them, sir, but we now have 225 cyber or security experts around the world. We made substantial investments over that time frame. In the last three years alone, we've invested approaching a quarter billion dollars in security.

C

Congressman from California1:46:45

There's an IBM benchmark that says financial services companies tend to be best-in-class, spending somewhere between 10 and 14 percent of their IT budget on security. Well, when were you notified of the vulnerability in the Apache Struts system? Days before the attack occurred?

R

Richard Smith1:47:07

Yes, we were notified by Department of Homeland Security in March of 2017, and the attack occurred after the notification.

C

Congressman from California1:47:18

So was there a human failure? I mean, how could 250 professionals that are designed and hired for that purpose let a breach like that happen after they were notified?

R

Richard Smith1:47:31

Yes, Congressman, it happened. And as I said in my oral testimony, the notification came out, we had a communication process in place. I described it as a human error: an individual did not ensure the communication got to the right person to manually patch the application. That was subsequently followed by a technological error: a piece of equipment we use, which scans the environment looking for that vulnerability, did not find it.

C

Congressman from California1:48:08

That seems like a lack of confidence or a professional error of some kind. Would you call it that?

R

Richard Smith1:48:18

I described it as a human error and a technology error. I apologize, but that is what happened.

C

Congressman from California1:48:22

Okay, moving on. Do you believe that the FTC has an important role in protecting consumers from future data breaches? How much of a role should the FTC be playing at this point given what's happened?

R

Richard Smith1:48:35

I think there's a role for the business to do more and industry to do more. We talked about earlier this concept of offering the consumer the ability to control their data and lock and unlock when he or she so chooses. And if there's particular legislation that arises out of this horrific breach, I'm sure you'd find management at Equifax and the industry willing to work and cooperate with the regulators.

C

Congressman from California1:49:03

Well, the reason I'm asking is the Federal Trade Commission is an enforcement body but it doesn't have any rulemaking authority. Do you think the FTC should have rulemaking authority? Would it have made a difference? Do you think it will make a difference in the future? Or do you have an opinion?

R

Richard Smith1:49:19

I have no opinion.

C

Congressman from California1:49:22

Well, my final question is: how long will individuals be vulnerable to identity theft problems due to this breach?

R

Richard Smith1:49:28

Congressman, we offered five different individual services. As you may or may not be aware, effective September 1st is the ability to monitor your credit files from all three of us for free, and others to lock your file. Another is dark web scanning. But that doesn't answer your question. How long are we going to be vulnerable? Our Social Security numbers are out there, this is forever, right? Unfortunately, the number of breaches... my Social Security number has been on the rise as you know. So there's another thought: as we think about how secure really is an SSN, and is that the best identifier for consumers going forward?

C

Congressman from California1:50:14

Thank you, Mr. Chairman.

G

Greg Walden1:50:17

The gentleman's time has expired. The chair now recognizes the gentleman from Kentucky for five minutes.

C

Congressman from Kentucky1:50:22

Thank you, Mr. Chairman. Thank you for being here, Mr. Smith. I appreciate you being here to testify. And I have a medical hearing going on upstairs, so I've been back and forth, so if I'm trying to double a question, but I was here earlier. A lot of people have asked a lot of questions. You know, July 31st was a suspicious activity, and then it seemed the activity or the notice to the board was about three weeks later, August 24th to 25th. So not to repeat, but I know I heard you say that it was suspicious activity and therefore you didn't realize it was a breach, and then the action took place three weeks later. When you did, looking back now knowing how colossal this is, how big it is, would you have done something different? From July 31st to August 24th, what would you have done different that didn't happen or Equifax didn't do?

R

Richard Smith1:51:11

Congressman, that's an appropriate question. To be honest, time for reflection will come. There's been no time for reflection. This has been a team of people including myself working around the clock for the last six to eight weeks trying to understand the forensics, trying as best we could to stand up an environment to offer consumers services to protect themselves. There will be an opportunity for me to have time to catch my breath and reflect, but I have not had a chance to do so now.

C

Congressman from Kentucky1:51:44

I appreciate that. Well, it was 1.9 million Kentuckians exposed in this hack. One of the questions that we have about the process Equifax underwent to help people determine that was setting up a new website, not just a portal within your website, for consumers to visit. Was that an appropriate response? I know there were some issues with getting onto the website. Were you part of the deliberation? Why did you choose to set up a new website that seemed to cause issues as opposed to just doing a portal on your current website?

R

Richard Smith1:52:18

Congressman, good question. It was strictly due to the sheer volume of incoming visitors that we had expected. The traditional website that we'd use to interact with consumers services a total of maybe seven to eight hundred thousand consumers at any given point in time. Over a period of time, I mentioned in my opening comments earlier, this new microsite as we call it that we set up had the capacity to surge to much higher levels. We had some 420 million consumers come to visit us in the first three weeks on that website. Our traditional Equifax website could not have handled that volume.

C

Congressman from Kentucky1:53:01

Okay. According to reports, many consumers weren't able to determine with certainty if their information was breached. So what was Equifax unable to provide clarity or certainty on whether individuals' information was breached when you went to the website?

R

Richard Smith1:53:15

Congressman, you typed in six of your nine digits of your Social Security number. If it was likely that you were breached, it would say something along the lines of 'it looks like you may have been compromised' as opposed to 'definitely you've been breached' because we only used six digits versus nine. But the point is, we offered this service, these five different services, to every American. It didn't matter if you were compromised or not; every American was offered the same services.

C

Congressman from Kentucky1:53:51

So, just going forward, because we have to also do an analysis of what we're going to do as a legislative body going forward to protect the American people, and what your business does and what role your business plays is important. It's when you can sit down at a car dealer and walk away with a car that afternoon because somebody can check that you're creditworthy. Having those types of services are available. So what steps is Equifax doing to rebuild the confidence? People aren't confident that their information is flowing out there, but the ability to access credit almost immediately if you have the proper credit is something that your services provide. But the risk is having all that information in one place for the convenience of what your type of business serves. So what are you doing to rebuild, or how can people be confident that this can go forward?

R

Richard Smith1:54:45

Congressman, that's a really good question. We're an 118-year-old company, and we've done a lot of great things for consumers over those 118 years. We take being a trusted steward seriously. So step one is to make sure we think more holistically and broadly about steps we can have taken to make sure we are more secure today than we were at the time of the breach. Second thing we can do is offer these services to consumers. We offered it on September 7th to make sure they are protected. Third is to launch this whole paradigm shift effective January of next year, which is to put the power of control of the consumer's credit in the consumer's hands, not our hands.

C

Congressman from Kentucky1:55:28

Thank you, that would be helpful. I appreciate that. I now yield back.

G

Greg Walden1:55:34

Thank you very much. The gentleman's time has expired. And pursuant to committee rules, we'll go with the members on the subcommittee by order of appearance, and then after that the non-subcommittee members. So the chair would recognize the gentleman from Florida for five minutes.

C

Congressman from Florida1:55:50

Thank you, Mr. Chairman. I appreciate it. Mr. Smith, one of my constituents accessed Equifax's website, equifaxsecurity2017.com, to determine if they were affected. They informed me that whether you submit your own identifying information or whether you submit a random name and Social Security number, you get the same message that you may be affected. What course of action should consumers who haven't received correspondence yet as to whether they're affected take? And if they were affected, what are the next steps?

R

Richard Smith1:56:31

Congressman, it's my understanding that those who went online to register and were not notified immediately, that backlog is completely now drained, if you will. So if you are trying to sign up for the service and answer the question correctly, you have now been notified.

C

Congressman from Florida1:56:48

Okay. I understand that Equifax currently is waiving fees to freeze and unfreeze your credit. How long is that exemption going to stay in place? Because it's very important.

R

Richard Smith1:57:05

Congressman, we announced on September 7th the ability to lock and unlock your file at Equifax for free for one year from the time you sign up. We've also announced a product we've been working on for quite some time, effective in January of 2018, the ability to lock and unlock your file with Equifax for life for free. That'll be the next generation of the lock that we offered in September.

C

Congressman from Florida1:57:32

Okay. As CEO, what level of involvement did you have with regard to data security and data protection? Yes, obviously the buck stops with you, I understand that. But what level of involvement did you have?

R

Richard Smith1:57:52

Data security reported to a direct report of mine, my general counsel. And I would have active involvement with my general counsel and with the head of security routinely throughout the year.

C

Congressman from Florida1:58:06

Okay. What responsibilities did Ms. Mauldin—again, the chief security officer at Equifax at the time of the breach—have with respect to data security, data protection, and data breach notification? Why were her responsibilities?

R

Richard Smith1:58:23

Those were core responsibilities. She was the head of cyber security and physical security in all 24 countries we operate.

C

Congressman from Florida1:58:35

How many briefings did you have with Ms. Mauldin between March 8th and July 29th of 2017?

R

Richard Smith1:58:45

I don't recall. We have routine meetings where we go through security strategy, security quarterly reviews, investment decisions required for security. The actual number of times in that time frame, I don't recall.

C

Congressman from Florida1:59:04

So it's half a dozen, a dozen? That would be a guess?

R

Richard Smith1:59:11

It would be a guess. More than three. If it's important to you, Congressman, we can find that information.

C

Congressman from Florida1:59:18

I appreciate that. What responsibilities did Mr. Webb, the chief information officer at Equifax at the time of the breach, have with respect to data security, data protection, data breach notification?

R

Richard Smith1:59:32

Directly, none, sir. He was expected, obviously as the head of technology, to work closely with the head of security, but the security function was a separate function. You can't do security without IT, you can't do IT without security.

C

Congressman from Florida1:59:47

How many briefings did you have with Mr. Webb again between March 8th and July 29th of 2016? If I may just clarify, on March 8th is when the CERT came out saying there was a vulnerability in Apache Struts. I was not even notified to put in perspective that there was an incident. I didn't know what the incident was until July 31st. So the number of meetings I would have with Dave Webb would not have been related to this incident.

R

Richard Smith1:59:58

Congressman, I understand. Thank you. I yield back.

C

Congressman from Florida2:00:04

Thank you very much. The gentleman yields back. The chair now recognizes the gentleman from Indiana for five minutes.

G

Greg Walden2:00:27

Mr. Chairman, thank you for being here. And again, I was at the health subcommittee hearing too, so I'm back and forth. Sorry about that. But is it possible that people who never signed up or used Equifax directly could have been impacted by the breach?

C

Congressman from Indiana2:00:43

Yes, Congressman.

R

Richard Smith2:00:45

Okay, so how does Equifax get the information on people who've never directly associated with Equifax at all? I mean, I'm not familiar with that.

C

Congressman from Indiana2:00:54

Yeah, we get it from banks, telecommunications companies, credit card issuers, and so on and so forth. So just like you know, we go to apply for a loan, they send you the information because they want to get the data on my credit rating, for example.

R

Richard Smith2:01:13

Correct. As I define it, we are part of a federally regulated ecosystem that enables banks to loan money to consumers.

C

Congressman from Indiana2:01:19

So it's up to the banks at that point to notify the individual which credit agencies they're utilizing to assess their credit risk, or is it up to the credit agencies?

R

Richard Smith2:01:30

Traditionally, the contributors of the data, in that case the banks, would give their data to all three. That's the benefit of the system: you get a holistic view of an individual's credit risk.

C

Congressman from Indiana2:01:43

Yeah, my point is, I guess, because a lot of people I talk to back in Indiana, southern Indiana, have no idea who Equifax is. And many of those people have applied for home loans and other things, and in fact probably at some point you have their information, but they just may or may not have been notified who sent the information to them. Probably the bank or other agency. And that's just something I think that is also maybe an issue: people don't understand or have not been told who is being used to assess their credit risk, and hence something like this happens, they have no idea whether or not their information has been compromised.

R

Richard Smith2:02:23

I understand your point. I also have a lot of constituents in rural and lower-income areas that may or may not have access to the internet and Wi-Fi. The penetration of that is interesting. Depending on where you are, people who actually have Wi-Fi and the internet is not as high as you might think in rural America. But some of those people still have probably applied for loans and other things where their information could have been acquired by your company. How are you notifying all of those people other than saying that you have a website? You may have already answered that, and I apologize if you have, but that's important because again, the penetration of people having access to the internet may not be as high as you think when you come out to rural Indiana and other areas.

C

Congressman from Indiana2:03:11

Yeah, coming from Indiana, I understand. Congressman, we have set up the website that you mentioned, and we issued a press release across the country. We've also set up for those who don't have access to the web or the internet, call centers. We staffed up; we went from some 500 call center agents to over 2,700.

R

Richard Smith2:03:34

So I guess that's again, I understand the call centers now. I knew you had done that, but I guess that's again making the assumption that people have watched the news and know that there has been a breach and that they take the proactive step in trying to find out whether they've been involved or not. Is there any other than passive way for them to find out? Is there anything proactive from Equifax's point of view that might notify them that their data may have been compromised?

C

Congressman from Indiana2:04:01

Well, in many states, there are local requirements, state requirements, to take out advertisements in newspapers and so on and so forth. We follow those. One indication I did mention earlier, may or may not help those in rural Indiana, but the visibility this has gotten is extremely high. I mentioned 400-some-odd million consumers had come to our website. So it's gotten the press, and probably after today it'll be more. People will know.

R

Richard Smith2:04:33

Thank you for answering those questions. I do have, like I said, my main concern is that my constituents understand whether or not their data has been compromised and then what are their options going forward. You've outlined most of those things today. I'm not going to ask you that again, but I do think it's important to recognize that although they are important passive ways for people to become aware of their data may be compromised, one approach also is active information and actively informing people proactively might very well be important in certain areas of the country. Thank you. I yield back.

G

Greg Walden2:05:14

The chair recognizes the gentleman from Texas for five minutes.

C

Congressman from Texas2:05:20

Thank you, Mr. Chairman. And I apologize, we have the health subcommittee upstairs and I appreciate it. But that's not the takeaway. The importance of this hearing — I want to thank you and the ranking member for setting it. We're here to discuss one of the worst and most impactful hacks that we've seen. It's a breach that was entirely preventable due to a level of negligence that in some industries may be considered criminal. The credit reporting industry is famously unforgiving, and it is an industry that helps perpetuate the cycle of poverty. Agencies like Equifax force those with lower credit scores to pay more money for loans and mortgages. Less than perfect credit scores can even result in higher rates for products that don't require credit, like auto insurance premiums. These people have a harder time paying back, higher interest rates make it more likely they won't be able to pay their debt back on time, and will hurt their credit further. Yet Equifax and the rest of the credit reporting industry expect forgiveness for breach after breach, lobbying Congress for even less liability. When restaurants fail regular health inspections, they are routinely shut down for violations. They are shut down even if problems haven't yet occurred as a consequence of their violations. It isn't clear to me why Equifax, which is beyond that point, should be allowed to continue operating when they have failed spectacularly at their core business and endangered the public. In the next couple of weeks, Senate Republicans may repeal the Consumer Financial Protection Bureau's arbitration rule, thus allowing companies like Equifax that put clauses in their fine print forcing individuals into arbitration agreements instead of class-action agreements where they stand a chance of recovering some of their losses. But it should be clear to us by now that this is not the time to roll back consumer safeguards in the financial industry. I support my colleague, the ranking member, Congresswoman Schakowsky's Secure and Protect Americans' Data Act. I look forward to hearing what our witness has to say. Mr. Smith, identity theft protection companies have seen a big jump in business and share price since the breach of your company, including LifeLock, who has reported a tenfold increase in enrollment for their credit monitoring and other services. LifeLock has a contract to purchase credit monitoring services from Equifax, meaning that every time someone signs up for LifeLock protection from the impact of the Equifax data breach, they are again involuntarily signing up for Equifax to provide those services, and Equifax makes money on that breach. What's the value of that contract that LifeLock has with Equifax?

R

Richard Smith2:08:10

Congressman, I don't recall what that is. But at the same time, those same consumers have the ability to come to us directly and get a free product.

C

Congressman from Texas2:08:20

Okay, if it's available, I'd hope you'd share it with the committee. Mr. Smith, Equifax reports marketed to its business customers say that 'Leading lifestyle databases available commercially offer hundreds of response segments covering almost every conceivable aspect of how consumers live and what they spend their money on and what interests they have.' Can you tell me, tell us, as granular level as possible, what the sources are for that data for every conceivable aspect of a consumer's life?

R

Richard Smith2:08:56

Congressman, I'm not quite sure what you're referring to. We are not a data provider in the area of behavioral analytics, behavioral data, social media data. So I'm not quite sure what you're referring to.

C

Congressman from Texas2:09:11

Well, I have a lot of constituents who are concerned about, for example, they say, 'Oh, I don't need to worry about this breach, I haven't applied for credit for 10 years.' But that's not always the case because these hundreds of millions who are released, maybe they bought a car 20 years ago and that data still goes forward. I assume, Mr. Smith, Equifax's customers are businesses who purchase data and credit reports on consumers. The American public is essentially Equifax's product. How many times per year on average does Equifax sell access to a given individual's credit file to a potential creditor, and how much do they make every time they sell it?

R

Richard Smith2:09:56

If I understand the question, Congressman, we take the data that is given to us by the credit ecosystem of the U.S., apply analytics to it, and then when a consumer wants credit, again through a credit card, home loan, a car, the bank then comes to us for that data and that analytics, and we charge them for that.

C

Congressman from Texas2:10:18

Okay, well, the question was: how many times does Equifax receive payment for that individual's credit file? Every time? If my local car dealer contacts Equifax, they pay a fee to Equifax for that information?

R

Richard Smith2:10:37

Yes, Congressman. If you as an individual want to go to that car dealership and get a loan for a car, they come to us or our two competitors, and when they take your data, access your data, we do get paid for it.

C

Congressman from Texas2:10:53

Okay. The clock wasn't started right. You have about 15 seconds. I'm sorry, you have about 15 seconds. The clock didn't start on you. So okay. I thought I just had a perpetual five. Mr. Chairman, I just have one more question. The products that Equifax is so far providing victims of the breach do not include anything they wouldn't need if it weren't for Equifax's laxness on their data. You have made more than $69 million in 2016, and so that's the concern that this committee has, and I know we have for all our constituents. I thank you, Mr. Chairman, for your time.

G

Greg Walden2:11:33

Thank you very much. I appreciate the gentleman's questions. The chair now recognizes the gentleman from Oklahoma for five minutes.

C

Congressman from Oklahoma2:11:39

Thank you, Mr. Chairman. Mr. Smith, what is your current job?

R

Richard Smith2:11:43

I'm retired.

C

Congressman from Oklahoma2:11:48

You're retired. Are you still getting paid by the company?

R

Richard Smith2:11:50

No, I'm fully retired, and so I have no affiliation at all with the company. No, Congressman, what I agreed to do because I love this company, I spent 12 years with 10,000 people trying to do the right thing, is I told the board it was right for me to step down, have new leadership take this company in a new direction. So when I retired, I agreed to work for as long as the board required for free, to help make it right for the consumers. So the affiliation is through doing free work with the Board of Directors and the interim CEO.

C

Congressman from Oklahoma2:12:25

So you're not getting paid in any manner? Not any type of shares, no stocks, anything?

R

Richard Smith2:12:32

Nothing. The day I announced my retirement, I still own stock in the company.

C

Congressman from Oklahoma2:12:43

I'm sorry, do you still own stock in the company?

R

Richard Smith2:12:45

Oh yes, I've been here for 12 years.

C

Congressman from Oklahoma2:12:51

Have you sold any of it recently since this has become known to the public during this breach?

R

Richard Smith2:12:58

No, no, sir.

C

Congressman from Oklahoma2:12:59

Are you aware of individuals who have?

R

Richard Smith2:13:02

Yes, there are three individuals who reported directly to me. There is a CEO who sells stock, yes. And they are all three of them are men I've known for a number of years, two for almost 12 years and one for three or four years, and they are men of high integrity.

C

Congressman from Oklahoma2:13:19

Did they sell it before this went public?

R

Richard Smith2:13:21

Yes, as I said, before the knowledge we went public with this on September 7th.

C

Congressman from Oklahoma2:13:30

When did they sell their stock?

R

Richard Smith2:13:32

August 1st and 2nd.

C

Congressman from Oklahoma2:13:36

So after the breach?

R

Richard Smith2:13:40

No, sir. The timeline: the end of July, 29th and 30th, notification on the 31st of suspicious activity. At that time, one or two days prior to their selling, there was no indication. So what would cause them to sell? There is a what we call a Section 16 officer. There is a limited window in which they can sell, tends to be right after the earnings call for no more than 30 days. So this is a natural process. The window opened after the second quarter.

C

Congressman from Oklahoma2:14:16

Okay. Well, in your opening statement, you made mention that there was an error in the portal and it was three weeks before you were notified of a breach. If I can clarify, there was a software, it's called an open source software, that was deployed in this environment, this consumer dispute portal. We never found that vulnerability, didn't patch that vulnerability. That was the issue. So who was in charge overseeing that? Who was supposed to be watching those borders for you?

R

Richard Smith2:14:51

Ultimately, me.

C

Congressman from Oklahoma2:14:52

I know ultimately you, I get that. But who did you have hired that was supposed to watch that?

R

Richard Smith2:14:56

On the vulnerability side, there was a department dedicated to this. There is a chief information officer who was ultimately responsible.

C

Congressman from Oklahoma2:15:04

Is that person still over that department?

R

Richard Smith2:15:08

No, sir, he's gone.

C

Congressman from Oklahoma2:15:18

You said you put in, once you were made aware of the breach, you put in plans of action, right? The first one was notification, second one was a call center, third one was increase cyber attacks preparing for that, fourth one was coordinating with...

R

Richard Smith2:15:37

Congressman, I understand. Thank you.

C

Congressman from Oklahoma2:15:39

Thank you.

U

Unknown2:15:44

I'm also or was CEO not on the company size that you have, but from the companies that my wife and I have had, and we have protocols put in place of what could happen. We know cyberattacks happen, you hear it every day on the news. These four things that you named were common sense things that should have been put in place to begin with. It should be in the fire alarm. You're in that world, this should be on the side of the wall where you pull the handle and immediately goes into place. How was it that it was just now thought of that you need to have four common-sense principles put in place on how to react to something in a world where we knew you were vulnerable? That we have protocol, the team follow protocol. This is well known what to do: from hiring a cyber forensic expert, we knew what to do, we've done it before; engaging a world leading cyber arm of a law firm, we knew what to do. These are all protocols that they knew what to do. The one thing, congressman, it's not a switch on a wall. I built to stand up the environment we had to stand up. It took a long time to stand up, and that's the issue that we have here. You are on the leading front of this, and the four things that you identified to me, I don't mean to simplify it by saying a switch on the wall, but these protocols should have already been put in place, and you should have reacted much, much sooner than what took place with that. I'm sorry, I don't mean to cut you off, and the Chairman has indulged me longer than what he should have, and I appreciate your time. Thank you, thank you for watching, gentlemen. Time has expired.

G

Greg Walden2:17:28

The chair now recognizes the gentlelady from California, Mrs. Waters, for five minutes.

M

Maxine Waters2:17:35

Thank you, Mr. Chairman. Mr. Smith, before I get to my question, I just want to say that on behalf of the 15 million Californians whose information was exposed, we expect better. Your business model was based on collecting and maintaining the most sensitive information on folks, and you let us all down, and that happened on your watch. And from my briefings, it appears that this could have been and frankly should have been prevented. Now, Equifax's business model depends on gathering consumer information, repackaging it, and selling it. Equifax has set up a website in which consumers can enter information to determine if they are at risk and sign up for credit monitoring and credit lock. To participate, a person has to give Equifax the same type of personal information including social security number, which Equifax put at risk in this breach. I want to know what Equifax is planning to do with this information besides offering credit monitoring and credit locks. Can you assure me that Equifax will not plug this information back into its core business operation and sell it to its lenders? Equifax should not benefit from this situation, and I want to know that Equifax is going to wall off this information and guarantee that the company will not profit from this situation.

R

Richard Smith2:18:57

Congressman, thank you for your comments. And as I mentioned in my written testimony, my oral testimony, and I've said throughout the morning, I'll say again today: as a CEO, it was under my watch, I'm responsible, I'm accountable, and I apologize to all your consumers in California. The intent of this offering that we're giving to your constituents in California and consumers across the country is in an environment where we're not going to sell other products. It's to come there and be serviced with protection of the five offerings you had mentioned, not to sell and take your data and monetize that. It's to take and protect you with these five services.

M

Maxine Waters2:19:41

Equifax's breach notification website uses a stock installation of WordPress. This causes me a lot of concern because it seems to have insufficient security for a site asking people to provide part of their social security number. Can you assure me that this website is secure and will not further endanger the personal information of my constituents?

R

Richard Smith2:20:05

Congressman, we took what we believe was the right amount of time working hastily from late August to going alive on the seventh. One of the four work streams the congressman from Oklahoma mentioned was assuring we were prepared for increased cyberattacks, as told to us by forensic examiners. And one of the first things we did was ensure that the website they were bringing consumers to get these free services was as secure as possible. That was one of our top priorities.

M

Maxine Waters2:20:35

Okay. And finally, my last question is: how many US consumers have enrolled in the credit monitoring service TrustedID? I'll just finish here because I know multiple people who have enrolled, including my immediate family, and they were told that they would receive an email to complete the process. After days of waiting, they have not received an email. I want to know what the delay is in processing this protection and when they will be able to complete the process to help protect their information.

R

Richard Smith2:21:04

I understand the question. I mentioned earlier that over 400 million consumers have come to the website. Obviously we don't have 400 million consumers in the country, so a number of them came back multiple times, but it's a lot of volume. Number two, I was told in the last few days that the backlog waiting for those emails has now been fulfilled, had been drained. As you come into the system, it's a more immediate response, so the team has made great progress in the last couple of weeks.

M

Maxine Waters2:21:30

Okay, thank you. And I yield back the balance of my time.

G

Greg Walden2:21:32

Thank you very much. The gentlelady yields back. And the chair now recognizes the gentleman from Pennsylvania for five minutes.

R

Representative from Pennsylvania (1)2:21:40

Thank you, Mr. Chairman. I've heard from hundreds of constituents in my congressional district. There are approximately five and a half million in Pennsylvania. I've reviewed each and every one of the constituent stories that I've received, and amongst my growing concerns: your baseline security practices leading up to the breach, the company's awareness of the breach developments and relevant timing, how consumers can get assistance in securing their accounts, how reliable the recovery efforts are in the wake of the breach, and the path forward long-term for consumers' personal information and making sure they are safe despite the breach. And it's this last one that is so particularly angering because it is going to potentially be so destructive to hundreds of millions of Americans what might happen to them in the years to come. And as the head of the company and throughout the company, the culture that company has to know how predictable the damage can potentially be. And so I ask you: is it not predictable how bad it might get for the individuals who have been compromised in terms of how much damage could be wrought upon them individually in the years to come?

R

Richard Smith2:22:59

Congressman, let me start by saying that like you, I've talked to constituents, consumers across this country who've been impacted. I personally read letters from consumers complaining, voicing their anger and frustration, so I know what you're seeing back home in Pennsylvania. But I think the anger is going to be multiplied thousands of times when something actually happens. And so when you talk about how predictable some of this is, the rollout of the call centers in the second rollout and the third rollout, it has to be predictable how massive this is and what would need to be put in place from a protocol perspective in order to address what's coming. And the slow rollout and how poor it was done, to me it's just inexcusable. I mean, you have to have departments dedicated to dealing with this potential, and it doesn't appear to me as though that was planned, or if it was planned, it was planned extremely poorly.

R

Representative from Pennsylvania (1)2:24:06

I understand your point, but it requires a little more color. We went from 500 call center agents to a need of almost 3,000 properly handled call center agents to handle consumer calls. It took time. We did the best we could in a short period of time. We ramped those up. I mentioned in my opening comments two of our larger call centers in the first weekend were taken out by Hurricane Norma. We were not prepared for that kind of call volume.

R

Richard Smith2:24:34

How couldn't you be? How couldn't you be? It's not our traditional business model. We are traditional business models dealing with companies, not 400 million consumers.

R

Representative from Pennsylvania (1)2:24:47

But your business model has a couple hundred million customers. So on a breach of this scale, obviously you're going to have at least that number and probably twice that amount of people calling inquiring as to whether or not they're subject to the breach. And that wasn't done.

R

Richard Smith2:25:04

Congressman, the difference is again the primary business model we have is dealing with companies, not with hundreds of millions of consumers. We did the best we could, reacted as quickly as we could. I'd mentioned that the service is getting better each and every day. We've listened to consumers' feedback, tried to make changes to the website and to the call center.

R

Representative from Pennsylvania (1)2:25:25

You're familiar with the Safeguards Rule that's essentially what you operate under, yes? How often does a forensic consultant issue a letter or a certification, or a law firm issue a certification that they feel your protocol is in compliance with the Safeguards Rule?

R

Richard Smith2:25:40

We are in compliance.

R

Representative from Pennsylvania (1)2:25:43

How much or how often that is actually communicated? How would you know that you're in compliance then? Because if you said you follow protocol and protocol led to this, then it's very difficult for me. I mean, that calls into question whether the Safeguards Rule is sufficient enough, because if you're saying that you're in compliance with it and you follow protocol and this still happened, that unearths a whole other set of questions.

R

Richard Smith2:26:07

The speed of reaction and the scale of the reaction was unprecedented. I'm not making excuses, but there's a corporate governance issue here as I see it. And that is your board of directors gets together, your CEO, you have a chief information officer, you have chief security officer, and at least once a year and probably quarterly, you have I presume outside forensic consultants doing this stuff every single day from you on retainer. And the speed at which you have to do this just to run your company operationally, you don't ever stop it. It's obviously ongoing and persistent. And it just seems to me that through insurance policies, through reporting to your board, through your board wanting to make sure they're doing their job, you're going to be looking for certifications from your outside security forensic consultants doing audits to say, 'Yep, you're doing good, you're doing good. Here are the new threats, here's how we're updating.' And I just don't see that's the kind of information I think would be extremely helpful that we have not received any information from today. But I would ask you, since I'm well over my time, that I'd like to know how often your board asks you to certify whether or not you're in compliance, and what is that protocol, and when was the last time you updated that protocol? You said you've complied with protocol. When was the last time that that was updated?

I understand your question. We'll get you the information.

R

Representative from Pennsylvania (1)2:27:31

Do you yield back? You're already well over.

I yield back. Time has expired.

G

Greg Walden2:27:35

The chair now recognizes the gentlelady from New York for five minutes.

R

Representative from New York2:27:49

Thank you, Mr. Chair. Americans should know their sensitive personal information is safe. Their security is exposed when private companies including Equifax can collect their private information without their direct knowledge or consent. And it's why I'm co-sponsoring Representative Schakowsky's measure, H.R. 3896, the Secure and Protect Americans' Data Act. Mr. Smith, we are here today because months after the breach actually took place, your company Equifax revealed that its for-profit business practices have exposed the highly sensitive personal information of some 145.5 million Americans and counting. Your data breach exposed a critical vulnerability in the American economy and the information security of the American people. The victims of this breach span every age group, every race, class, and other demographic. They now face a lifetime at risk of fraud, identity theft, and other crimes as a result of the private data that you exposed. I have many, many questions, but allow me to be the conduit through which my constituents ask you, Mr. Smith, their questions. I'll go first. Gerrit, a constituent, pointed out to me it would be wrong to call the victims of this breach Equifax customers. Most of them never asked to be tracked and judged by a private company with little public oversight or accountability. This is unacceptable. And he asks why he's been impacted in this manner. Any comment to Mr. Gerrit's question?

R

Richard Smith2:29:27

Again, Congressman, I have read many similar letters and talked to people back home in Atlanta who voice that same concern. I can tell you this: our company has been around for 118 years, has 10,000 employees trying to do what's right each and every day. I apologize to the individual who wrote you that letter. I apologize to America for what happened, and we're going to try to make it right.

R

Representative from New York2:29:52

My constituent Jason from Albany asked: Mr. Smith, did you to the best of your knowledge employ the best and most effective defense available to you to prevent this breach?

R

Richard Smith2:30:06

You know, a crisis that never occurs if everything's gone right. In this case, as I mentioned earlier, we had a human error and a technology error. It wasn't because we were unwilling or unable to make the financial investments in people, process, or technology.

R

Representative from New York2:30:23

My constituent Tanya asks: how do I get Equifax to fix this without signing over my rights, and what related costs will I, Tanya, be expected to pay over my lifetime?

R

Richard Smith2:30:33

The five products we launched, the services we offered in September, are all free. They're all spelled out in a press release. They give that individual significant protection. The most comprehensive change is coming in January of next year, which is the ability for consumers to lock and unlock their data when they want and only when they want. And any related costs that she should expect to pay: all services are all free.

R

Representative from New York2:31:02

A number of my constituents would like to know: given that the sole purpose of credit agencies is to secure handling of consumers' confidential information, which they spectacularly failed to do, why is this company allowed to continue to exist?

R

Richard Smith2:31:16

We have a rich history of helping those who want it to get access to credit. The company has done many great things to help those in the unbanked world who would never otherwise have access to credit because what we do brings them into the credit world.

R

Representative from New York2:31:35

Stitch from Albany asks: why are you using this gross misconduct to turn your victims into customers for a paid monitoring service that you will profit from?

R

Richard Smith2:31:45

That is not the intent. Our intent is to offer those five services for free, followed by the sixth service which is a lifetime lock for free.

R

Representative from New York2:31:55

My constituent Karen asks: why have you not notified each person whose data you compromised? Most never asked you to collect it and securely store their private information. So we are the representatives, and why should they be responsible for your malpractice?

R

Richard Smith2:32:11

Following the recommendation of those who advise us, we did notify through the press release notifying the entire population, not just those who were a victim of the criminal hack, but all Americans to get access to these products and services for free.

R

Representative from New York2:32:31

My constituent James from De Freitas Film, New York asks: why did it take you so long to announce the data breach, and why should you be held responsible for every day of failing to report?

R

Richard Smith2:32:43

I think hopefully my written testimony, my oral testimony, and the dialogue we've had today has talked about the timeline with enough granularity to help that person understand what occurred from March through September 7th.

R

Representative from New York2:32:59

And a constituent Stephanie from East Greenbush asked: do they know if the people were targeted or randomly picked? Why some but not others?

R

Richard Smith2:33:09

At this point, all indications are it was at random. There was not targeting individuals specifically.

R

Representative from New York2:33:17

I've exhausted my time, but let me assure you, Mr. Smith, I have many, many, many constituent questions that continue to pour forth, and we are going to provide those after the hearing here and would expect that they would all be answered. Again, thank you for your response. Thank you. I yield back, Mr. Chair.

G

Greg Walden2:33:36

Thank you very much. The gentleman yields back. The chair now recognizes the gentleman from Pennsylvania for five minutes.

R

Representative from Pennsylvania (2)2:33:44

Thank you, Mr. Chairman, for allowing me to sit on this hearing. My fellow members have already asked a lot of questions, very important high-level questions, but I want to take a few moments to dig a little more deeply into a few specific issues. We now know that Equifax's information security department ran scans that should have detected systems that were exploitable by the Struts vulnerability, but that the scans didn't detect any. Obviously at least one system was vulnerable. So if the scan wasn't properly configured to catch this vulnerability, in other words you missed a major breach, is it possible that it has also been improperly configured to detect similar vulnerabilities?

R

Richard Smith2:34:23

I have no knowledge of that being the case.

R

Representative from Pennsylvania (2)2:34:29

But now you have to feed information into these scans, and they have to be complete and accurate information. And this information apparently wasn't fed in. It was fed in an incomplete way, isn't it true?

R

Richard Smith2:34:40

Can you repeat the question, please?

R

Representative from Pennsylvania (2)2:34:43

In order to scan something, you have to feed it information. A human has to feed it information, right?

R

Richard Smith2:34:48

I am not a scanning expert, Congressman. My understanding is you've got to configure the scanner in certain ways to look for certain vulnerabilities.

R

Representative from Pennsylvania (2)2:34:57

Yeah, but a lot of what's going on here is your blame, and they said no humans are involved, but configuring is done by a human being, isn't it? Right. And some inaccurate information got in there too. So if it was improperly configured to catch the vulnerability, is it possible it has also been improperly configured to detect similar vulnerabilities?

R

Richard Smith2:35:14

I have no indication to believe that's the case.

R

Representative from Pennsylvania (2)2:35:16

We've also heard a lot about the website Equifax set up to handle the consumer protection response, equifaxsecurity2017.com. As it's been pointed out, this looks like a website that scammers would use for phishing. In fact, a report in the press said someone switched the words and made it into a phishing website that looked almost identical. Luckily, this person was just trying to make a point, but I think that point is well taken. They said earlier today that you set up this external website because Equifax's own domain wouldn't be able to handle the sheer amount of traffic. Now, why wouldn't your website be able to handle this traffic? I mean, it just doesn't make sense. A company of your size and knowledge doesn't understand how to handle traffic for over a hundred million people? Don't you use an elastic cloud computing service that would have accounted for this traffic?

R

Richard Smith2:36:02

Congressman, a point of clarification: if I made the phishing site that you referred to, it was mentioned a few times today, it was an error by an individual in a call center. I just wanted to have that established. But I want to answer your question. The environment the microsite is in is a cloud environment, it's very, very scalable. The traditional environment that we operate in could not handle 400 million consumer visits in three weeks.

R

Representative from Pennsylvania (2)2:36:38

Well, I want to come back to some of this stuff too. I want to come back to the issue of patching the March vulnerability. And now I know this has come a few times, but I want to make sure to highlight this point because it's critical in understanding how this breach occurred. Our understanding is that fixing this vulnerability required more effort than simply installing a patch, but we also understand that when Equifax did patch the vulnerability, it took less than three days to do so. So the patch only took a few days to apply. Why did Equifax fail to install it immediately after it was announced as critical?

R

Richard Smith2:37:09

Patching takes a variety of time. I'm not sure where you got the note that it's three days. It could take from days up to a week or more to apply a proper patch.

R

Representative from Pennsylvania (2)2:37:17

Did you notify everybody it was going to take some time? I'm sorry, did you notify all your customers it was going to take some time? Did you notify people there was a risk while you were trying to apply the patch?

R

Richard Smith2:37:27

No, there's no protocol that we'd notify customers.

R

Representative from Pennsylvania (2)2:37:29

So on a protocol, yes, did you notify people?

R

Richard Smith2:37:30

I have no knowledge that we notified customers or consumers of the patching process.

R

Representative from Pennsylvania (2)2:37:35

But you didn't notify anybody that the patch was going to take place, and in the meantime there was a risk that existed.

R

Richard Smith2:37:40

I have no knowledge of notifying other people.

R

Representative from Pennsylvania (2)2:37:43

Did other people, executives of your company, whether you were aware of it? As I've said before, I was not.

R

Richard Smith2:37:50

You were not aware that there was a problem with the vulnerability? You said you just told me it takes a few days, a few weeks, but you weren't aware that it existed?

R

Representative from Pennsylvania (2)2:37:57

That's correct.

Well, let me wrap up with one final thought here. In your testimony, you state that the breach occurred because of both human error and technological failures, or technology failures. So looking at the three issues I just highlighted: improperly configured scans, the poorly chosen website, the lack of patching. These are not failures of technology. A human misconfigured the scan, a human selected the website name, a human failed to apply the patch. Well, I understand that cybersecurity is an immensely complicated field. We've dealt with this many times in this committee, and sometimes flaws in the technology we rely on are really to blame. But I also think it's important to be upfront about the causes of breaches like this. If we continue to blame technology for human failures to provide adequate cybersecurity, I think we're going to have a very difficult time improving our capabilities and preventing future cyber threats. Mr. Chairman, I recognize I'm out of time. We'll see you again in my subcommittee. Thank you very much.

G

Greg Walden2:38:47

The gentleman's time has expired. And the chair now recognizes the gentleman from Maryland for five minutes.

R

Representative from Maryland2:38:55

Thank you, Mr. Chairman. Mr. Smith, thank you for being here. You have been the president of the company, CEO for 12 years, is that right?

R

Richard Smith2:39:03

That is correct.

R

Representative from Maryland2:39:07

There are three things I think the public is angry about. Certainly, as my colleague was indicating, we're getting a lot of messages and contacts, inquiries from our constituents across the country. First of all, they want to understand, and you've tried to explain it today, but I'm not sure it's going to be satisfactory: why there wasn't sufficient protections in place on the front end so that this kind of breach wouldn't happen in the first place, given the sensitivity of the information that you're keeping in the company. The second thing is how quickly, once a breach was discovered, you came clean to the public and provided information on what was happening. There seems to have been a delay there that concerns people. The third is whether the services that you're now providing to people, you've enumerated five or six free services that you're providing to people, whether that's going to be a sufficient assurance to folks going forward that their identity can be protected, that their information is safe, and so forth. So you're trying to fix things now, but there's going to continue to be, I think, serious questions about all three of those things that I just mentioned. I wanted to ask you about the kind of remedies that you have out there, because there's some confusion. I got a question from a constituent who had purchased a monitoring service that would cover his family, including a child under the age of 18. So first of all, can you tell me: is it possible for someone under the age of 18 to have their identity stolen?

R

Richard Smith2:41:06

Exactly correct. As far as you understand, is it possible? Yes.

R

Representative from Maryland2:41:12

As it relates to this breach, just generally, identity: if certain information about a minor is divulged to some unscrupulous actor, that can be used to steal the identity if someone has a social security number. Okay, any age can that be compromised? Yes. It could not be compromised in this case because this database they got into, it's my understanding, only had those who had credit active, you know, they've been in the credit environment. Okay, but my understanding is that when you provide a family service, your help mechanism that includes the social security number of people who may be under the age of 18, have no knowledge that under 18 not credit active was compromised here. I can look into that. Okay, I have no knowledge if that is the case. Is this free service that you are providing going to cover any exposure or information that's related to a minor as opposed to somebody who's over the age of 18? If you had information on that minor, they can look into that.

R

Richard Smith2:42:33

Congressman, the intent of the coverage was to cover anyone in America who is in the credit system. So if you're under 18 and not in the credit system, I'll check. One point which is on this concept called family plan that you're alluding to, where you can lock down consumers, you monitor consumers. I don't believe there are social security numbers in this system. We can verify that.

R

Representative from Maryland2:42:53

Well, that's important. If I could just interrupt, I think we had a little clock issue, about 30 seconds left. And I think it's important because it may be that with respect to credit reporting, the implications of this breach only attach to people that are 18 or older. But if you're holding information about minors, like a social security number, that's part of the portfolio of information you're getting from a family, for example, particularly when the family has paid for this service, you're holding their social security number. So any breach that makes that information available outside of the arena in which it's supposed to be kept closed creates vulnerability for that person. It's not like we get a new social security number when we turn 18, so that's going to follow them all the way through and create some real risk for them. So I think that's a piece of this that we need to understand much better, and I want to thank my constituents for sort of bringing that to our attention.

R

Richard Smith2:44:01

I understand your point. To the best of my knowledge, that data is not included in the breach. I'll look into it. Thank you.

G

Greg Walden2:44:10

The chair now recognizes the gentleman from Georgia for five minutes.

R

Representative from Georgia2:44:14

Thank you, Mr. Chairman, and I want to thank you for allowing me to sit in on this today. Mr. Smith, thank you for being here. I know it's been a tough day, it's been a tough past couple of weeks. Appreciate you being here, and that's important. I'm not going to apologize for my colleagues and their questions and their aggressiveness, if you will, because as you know, people are upset and they're mad. You get it, and I get it, we understand it. But nor am I going to pile on, so I want to kind of go a different route, if you will. One of the things that I've learned in two and a half years that I've been up here is to be very careful about my southern phrases, but one of my southern phrases has always been that you know, fool me once, shame on you; fool me twice, shame on me. And I want to know what we can learn from this now. This is not the first time that a data breach has happened. Perhaps it's the biggest that's ever happened, but it has happened to other companies before. Now, to the extent that you were prepared for this, or that it happened to you, I hope that was not due to complacency. I hope it was not due to you not doing everything that you could to have prevented it. But my question is this: can you share with us any information about the attackers? What do you know and what do you not know about them at this point?

R

Richard Smith2:45:28

Congressman, thank you for that. As I mentioned in my opening comments and in my written testimony earlier this week, we've engaged the FBI, and they currently have the investigation in their hands. So at this juncture, we're not disclosing what we know about the hackers.

R

Representative from Georgia2:45:45

How's your cooperation with the FBI? Is it your experience with them thus far been good? And you anything that... this is important, it's important for everyone. Yeah, everyone's upset and rightfully so, they should be upset when your personal data is out there. And obviously it's very upsetting, but I'm trying to go in a different direction. I'm trying to figure out how we can prevent this from happening.

R

Richard Smith2:46:11

The cooperation with the FBI, to the best of my knowledge, has been good. It's ongoing. We've got lines of communication into the FBI not just after a breach but routinely throughout the year, so I'd say it's been a very good cooperation.

R

Representative from Georgia2:46:24

Congressman, let me ask you this: through this scenario, through this experience rather, if you had to do anything different, what would you have done?

R

Richard Smith2:46:34

Congressman, when I was asked that question earlier, my answer will be the same now as it was earlier. There will be time for reflection personally and as an organization, coupled with the investigation that we continue to undertake to look at processes in-house. But at this juncture, since I was notified in mid-August through this morning, it's all been about the forensics, it's been about trying to protect and do what's right for the consumer. And there's been no time to reflect on what I would do differently.

R

Representative from Georgia2:47:07

That's okay. Well, when that time comes, we need to know, because we don't need to let this happen again, and other companies need to learn from it. And you know, this is obviously, as I said earlier, not the first. You're not the first company to suffer from this. You're not the first Georgia company to suffer from this. We understand that. Doesn't make it any less egregious to what has happened, but where I'm trying to go is: what can we do better to prevent this from happening again? These guys are good, we know that. Listen, cybersecurity is hard, it's way above my pay grade, I can tell you that.

R

Richard Smith2:47:44

Congressman, thank you for that. It does, as I mentioned in my comments, I take full responsibility as CEO, and I understand that. And I appreciate that. If there's one thing I'd love to see this country think about, it's the concept of a social security number in this environment being private and secure. I think it's time as a country to think beyond that. What is a better way to identify consumers in our country in a very secure way? I think that way is something different than an SSN, a date of birth, and a name.

R

Representative from Georgia2:48:24

Well, you're exactly right. I remember my time in the Georgia State Legislature when we changed the... you know, you should have your social security number on your driver's license. I used to be your driver's license number, you know, and we changed that, and that was not that long ago. And that's what tells me that this is something that is changing dramatically and quickly, and we need to be prepared for it. So I know that you're putting out fires right now, but at some point we need to learn from this. We need to know, look, we shouldn't have done this, we should have done that. What could we have done differently? What will benefit another company to allow that this doesn't happen? And I hope, and thus far you appear to have been honest about all this, I hope that if part of what the problem was was complacency, that you admit that and say, 'Don't ever let your guard down.' Thank you, Congressman.

R

Richard Smith2:49:18

I would love to be part of that dialogue about what lies ahead to protect individuals' identities.

R

Representative from Georgia2:49:24

Well, again, I want to thank you for being here, and it says a lot about you and about your company. Thank you. Thank you, Mr. Chairman. I yield.

G

Greg Walden2:49:32

The gentleman yields back. The chair now recognizes the gentlelady from California for five minutes.

M

Maxine Waters2:49:37

Thank you, Mr. Chairman. First, I'd like to recognize a former colleague that's here in the chamber with us, Saxby Chambliss, who served in the House and in the Senate. It's good to see you. Very nice to see you. Mr. Smith, it seems to me that you've accomplished something that no one else has been able to accomplish, and that is that you have brought Republicans and Democrats together in an outrage and distress and frustration over what's happened. Because this is huge. This is almost half of the country and their information. You know, the American people, I think they have privacy in their DNA. We don't like Big Brother. We don't like people having information on us. We know in an information and in a digital age that that's impossible, but boy, when that's breached, when the privacy goes out the window, it really puts a dent in people's lives. I equate it with... because they don't feel that they can do anything about it, they feel helpless. I come from earthquake country, and when that rattle first starts, you really do feel helpless, you feel absolutely helpless. Now, the question has been kind of posed rhetorically by some members because they've been sitting in for a while at this hearing: what can be done? I have the privilege of representing most of Silicon Valley. I have asked this question about the protection in terms of privacy breaches in our country to just about every CEO I've met, and they have responded like a chorus and said that there are two main reasons for breaches in our country: number one, a lack of hygiene in systems, and very poor security management. That's why I have legislation. Senator Hatch is the lead sponsor in the Senate, I have the bill in the House. So it's distressing to me knowing this information that Homeland Security notified Equifax this is almost seven months ago. This has to do with a patch. So I know there are a lot of questions that have probed this, but you as CEO at the time when Homeland Security informed your company that there was a breach, what did you say to your CIO officer? Did you understand what the breach was? Did you understand what the patch meant? Did you understand the timeliness, the need for timeliness to have this fixed? And did anything change in that department? Was there a new policy put in place by you?

R

Richard Smith2:53:13

Congresswoman, to clarify: when the CERT came out in March, there was no notification of a breach. It was a notification that... what it meant was an open-source software commonly used and deployed around the world called Apache Struts had a vulnerability, and the notification was that the vulnerability should be patched.

M

Maxine Waters2:53:51

All right. And what did you ask? If it was patched? We get notifications. You got the notification from Homeland Security. All right, what did you do about it the day you found out?

R

Richard Smith2:54:03

The company was notified on, I believe, the 9th of March. The security team followed protocol and instantly within a day set notification out to many people in the organization that a patch needed to be applied to Apache Struts.

M

Maxine Waters2:54:24

Did you ask your team when it was applied?

R

Richard Smith2:54:27

The security team did, and they spoke with the IT team as well.

M

Maxine Waters2:54:33

When did they take care of it?

R

Richard Smith2:54:37

It's about the testimony we've talked about what occurred. The following day communication was sent out to those who need to be notified.

M

Maxine Waters2:54:48

You already said that. I want to know when they did it, when they took care of it.

R

Richard Smith2:54:53

They took care of it in July because we never found it. It wasn't until... we did have the human error, we did the scan, the technology never found it. In July, we saw suspicious activity, took the portal down, found the vulnerability, applied the patch.

M

Maxine Waters2:55:15

Well, I think the chairman... we have in the rules of the full committee, which are approved at the beginning of every Congress, that members of the full committee can participate in subcommittees where they are not members, and I appreciate the legislative courtesy. And I think that there's a lot more to be done on this issue. Mr. Chairman, if I'd like to make the recommendation, I think we should have the CIO, the chief information officer, come in, because I don't think that this is resolved. So thank you. Thank you very much.

G

Greg Walden2:55:54

The gentlelady's time has expired. And we're just going to ask one quick follow-up question. I'm going to yield to the ranking member.

F

Frank Pallone2:56:09

First National Association and an article from the BGM TV. Without objection, so ordered.

G

Greg Walden2:56:16

Sorry. So in closing, Mr. Smith, I want to quote again from you from your testimony. You mentioned the five fixes, so-called, and you put this: 'This puts the control of consumers' credit information where it belongs, with the consumer.' So I ask you a question: what if I want to opt out of Equifax? I don't want you to have my information anymore. I want to be in control of my information. I never opted in. I never said it was okay to have all my information. And now I want out. I want to lock out Equifax. Can I do that?

R

Richard Smith2:57:05

Congresswoman, that requires a much broader discussion around the role of the credit reporting agencies, because that data, as you know, today doesn't come from the consumer. It comes from the furnishers, and the furnishers provide that data to the entire industry.

G

Greg Walden2:57:23

No, I understand that. And that's exactly where we need to go, to a much larger discussion, because most Americans really don't know how much information, what it is that you have, and they never said okay. So I'm hoping this will lead to a wider discussion. Thank you very much.

The gentlelady yields back. And if I may just go back to what we had a discussion earlier, going back to your testimony from August 15th, when you were informed that it appeared likely that consumer information had been stolen. Again, why was there again a 10-day delay between finding out about that personal information that could have likely been stolen to developing that remediation plan? Why would it take 10 days to sort that out, to develop that remediation?

R

Richard Smith2:58:19

Congressman, there was continuous work going on around the clock from that time through yesterday, trying to develop the product, build the communication plan, stand up websites, inform those who needed to be informed. It wasn't like on a certain date something occurred; it was continual motion by many people for many, many weeks.

G

Greg Walden2:58:42

Oh yes, just a quick follow-up on that then. Because again, within that 10-day period of time, when was the appropriate time that it was really to start talking to the consumers? At that point in time, or again waiting until when you did in September? Because again, there was a lag time where information could have been stolen on individuals.

R

Richard Smith2:59:01

The whole goal was to make sure the data we had was as accurate and clear for the US consumer as possible. Number two was to make sure for the forensic cybersecurity specialists that our environment was as secure as possible. They said to expect increased attacks. Number three was to stand up call centers and websites for hundreds of millions of consumers, and that just took time, as I alluded to earlier.

G

Greg Walden2:59:34

Thank you very much. And the thing that... there were no other members present to ask questions. We want to thank you very much for testifying before the subcommittee today. And pursuant to committee rules, I remind members that they have 10 business days to submit additional questions for the record. I ask that the witness submit their responses within 10 business days upon request of any questions submitted. Without objection, the subcommittee is adjourned.

Equifax CEO Richard Smith Testifies On Hacking That Compromised Millions Of Americans Personal Info

About Richard Smith