What I can't believe is why there's not a criminal case against these idiots? When you are controlling something dangerous and you allow that thing to harm someone else, it's a criminal offense. It's not a matter of whether it's hard. It's simply your responsibility to ensure no one gets hurt.
This company has already caused harm to literally everyone in the US. Minimally, we all now have to take action to attempt to avoid identity theft. And it only gets worse from here.
And these bastards have the chutzpah to wait until hurricane Irma is upon us to make the announcement.
Bourgeois law in its wisdom protects individual property owners from their mistakes, unless they affect owners of larger property... that said, Equifax may have just fucked over the entire retail/consumer credit industry in the US, so the hammer may very well fall on them. We might get some of those banker perp-walks everyone loves.
But with the current administration as well as Congress (we're likely to see a Federal gov't shutdown over the budget even though the Republicans control the legislature and White House), I wouldn't anticipate seeing any regulation down the pike because of this.
They mention the Struts vuln, but not which one... did an attacker access the info directly via a naive attack, or was this a campaign? Having worked on Enterprise-Ready(tm) systems I wouldn't be surprised if Equifax had an unsegmented network...
If people did not go to jail for the wells fargo fiasco where willful fraud was committed, I very much doubt anyone will go to jail for this. Although you are absolutely right, someone should be severely punished for this.
> This company has already caused harm to literally everyone in the US.
Not yet. People might be annoyed but not many of them have been harmed yet. They're harmed when their identity is actually stolen (i.e. used by someone else), not merely when someone gets access to their data.
(Not saying I like this system. Just saying this it how the system works.)
