Senator Warren questions former Equifax CEO Richard Smith after massive data hack

🎥 Oct 04, 2017 📺 Senator Elizabeth Warren ⏱ 6m 👁 135711 views

Banking Committee hearing. October 4th, 2017.

About Richard Smith

Former Equifax CEO Richard Smith testified before Congress in 2017 and 2018 regarding a data breach that compromised personal information of over 145 million Americans. Smith stated that the criminal hack "happened on my watch" and said he took "full responsibility" for the incident. He apologized to affected consumers and attributed the breach to a combination of human error, including a failure to apply a software patch, and technological error involving a scanner that failed to detect the vulnerability. During questioning, Smith said that Equifax's general counsel and other executives who sold stock in early August 2017 did not know it was a breach at the time, describing the incident as "suspicious activity" with no indication that personally identifiable information had been compromised. Smith stated that upon his retirement he agreed to step down with no further compensation, no bonus, and no severance. In a separate hearing, Senator Elizabeth Warren questioned Smith about Equifax's profits, which Smith confirmed had increased by more than 80 percent since 2013 despite multiple data breaches. Smith also acknowledged that Equifax receives revenue from LifeLock, a credit monitoring service that saw increased enrollment after the breach.

Source: AI-verified profile updated from Richard Smith's recent appearances. Browse all interviews →

Transcript (18 segments)

Senator0:00

Thank you, Mr. Chairman. Now, Mr. Smith, Equifax has been hacked several times in the past few years. It is consistently rated as having some of the worst data security practices in the financial services industry. And this latest hack happened through a hole in your system that had been identified months before and could have been fixed pretty easily. The whole thing is staggering. A company like Equifax that has sensitive personal information on most Americans should have the best data security in the industry, and instead it has the worst. And I want to understand why. So I started to look into this, and one thing jumped out at me. In August, just a couple of weeks before you disclosed this massive hack, you said, and I want to quote you here: 'Fraud is a huge opportunity for us. It is a massive, growing business for us.' Now, Mr. Smith, now that information for about 145 million Americans has been stolen, is fraud more likely now than before that hack?

Richard Smith1:08

Yes, in order is... yeah, so the breach of your system has actually created more business opportunities for you. For example, millions of people have signed up for the credit monitoring service that you announced after the breach. Equifax is offering one year of free credit monitoring, but consumers who want to continue that protection after the first year will have to pay for it. One thing, Mr. Smith...

No, Senator, the best thing a consumer could do is get their Lifetime Lock.

Senator1:38

I'm asking you the question. You're offering free credit monitoring, what you say is worth something, and you're offering it for only one year. If consumers want it for more than one year, they have to pay for it. Is that right?

Richard Smith1:48

Yes, Senator. If the most... the best thing a consumer can do is the Lock product.

Senator1:54

Okay, but they're going to have to pay after one year if they want your credit monitoring, and that could be a lot of money. So far, seven and a half million people have signed up for free credit monitoring through Equifax since the breach. If just 1 million of them buy just one more year of monitoring through Equifax at the standard rate of $17 a month, that's more than $200 million in revenue for Equifax because of this breach. But there's more. LifeLock, another company that sells credit monitoring, has now seen a tenfold increase in enrollment since Equifax announced the breach. According to filings with the SEC, LifeLock purchases credit monitoring services from Equifax. And that means someone buys credit monitoring through LifeLock, LifeLock turns around and passes some of that revenue directly along to Equifax. Is that right, Mr. Smith?

Richard Smith2:54

That is correct. That's correct.

Senator2:56

Okay. So from the second Equifax announced this massive data breach, Equifax has been making money off consumers who purchased their credit monitoring through LifeLock. Now, Equifax also sells products to businesses and government agencies to help them stop fraud by potential identity thieves. Is that right, Mr. Smith?

Richard Smith3:21

Yes, Senator. There's one clarification. You mentioned the LifeLock relationship was accurate. At the same time, the majority of that revenue would normally generate is direct-to-consumer. We've shut that down. We're no longer selling consumer product directly.

Senator3:37

I'm sorry, my question is: every time somebody buys through LifeLock, and they've seen a tenfold increase since the breach, you make a little more money. We actually called the LifeLock people to find this out, so I asked you the question, but I already know the answer. It's true. You're making money off this. So let me go to the third one. Equifax sells products to businesses and government agencies to help them stop fraud by potential identity thieves, right?

Richard Smith4:03

To the government, yes. Not to the business.

Senator4:05

You don't sell to businesses too?

Richard Smith4:07

We sell business, but it's not to prevent fraud. That's not the primary focus of the business.

Senator4:10

But just to stop identity theft, you don't have any products that you're touting for identity theft?

Richard Smith4:16

All I'm saying is the vast majority we do for businesses is not fraud.

Senator4:21

Sir, look, you've got three different ways that Equifax is making money, millions of dollars off its own screw-up. And meanwhile, the potential costs to Equifax are shockingly low. Consumers can sue, but it turns out that the average recovery for data breaches is less than $2 per consumer. And Equifax has insurance that could cover some big chunk of any potential payment to consumers. So I want to look at the big picture here. From 2013 until today, Equifax has disclosed at least four separate hacks in which it compromised sensitive personal data. In those four years, has Equifax's profit gone up, Mr. Smith?

Richard Smith5:12

Yes, sir. Yes, it has gone up.

Senator5:16

Right. In fact, it's gone up by more than 80 percent over that time. You know, here's how I see this, Mr. Chairman. Equifax did a terrible job of protecting our data because they didn't have a reason to care to protect our data. The incentives in this industry are completely out of whack. Because of this breach, consumers will spend the rest of their lives worrying about identity theft. Small banks and credit unions will have to pay to issue new credit cards. Businesses will lose money to thieves. But Equifax will be just fine. Heck, it should actually come out ahead. Consumers are trapped. There's no competition, nowhere else for them to go. If we think Equifax does a lousy job protecting our data, we can't take our data to someone else. Equifax and this whole industry should be completely transformed. Consumers, not you, consumers should decide who gets access to their own data. And when companies like Equifax mess up, senior executives like you should be held personally accountable, and the company should pay mandatory and severe financial penalties for every consumer record that's stolen. Mr. Chairman, we've got to change this industry before more people are injured. Thank you.