Welcome to Consumer Reports Advocacy

For 85 years CR has worked for laws and policies that put consumers first. Learn more about CR’s work with policymakers, companies, and consumers to help build a fair and just marketplace at TrustCR.org

CU Letter to Equifax CEO on Steps to Address Consumer Harms from Unprecedented Data Breach

Consumers Union, the policy and mobilization division of Consumer Reports, is an expert, independent, nonprofit organization whose mission is to work for a fair, just, and safe marketplace for all consumers and to empower consumers to protect themselves. We write to express our deep concern about both the immediate and lasting effects of the devastating breach that was announced by Equifax on September 7, 2017.

Your company has estimated that the breach compromised the highly sensitive information—including social security numbers, driver’s license numbers, and birthdates—of potentially 143 million consumers, nearly half of the U.S. population. The compromise of this information, apparently by malicious hackers determined to misuse it, leaves all affected consumers vulnerable to identity theft and other fraudulent uses of their information for years to come.

We recognize that Equifax, and likely many law enforcement agencies, are still investigating the facts surrounding the breach, as well as the question of whether Equifax had reasonable policies and protocols in place to protect the highly sensitive consumer data it collects, stores, and sells. However, it is clear that Equifax’s response to date has been wholly inadequate. Your company has offered affected customers only one year of credit monitoring and, following public outcry, a limited and narrow opportunity to obtain a free credit freeze. The company provided inadequate and unreliable information about which consumers were victimized and what information was compromised, limiting consumers’ ability to take steps to protect themselves. Equifax also originally forced victims visiting its site to waive their rights to sue the company for the harms caused and, following public outcry, has not fully corrected this problem. Further, the company does not appear to have fully investigated—and certainly has not explained to the public—the sales of stock by three top executives just prior to public announcement of the breach.

Given the extraordinary nature of this breach and the threat posed to nearly half of all Americans, Equifax has a responsibility to offer consumers the best resources and tools to help them protect themselves.