Equifax hack: 2.5 million more consumers may be affected by historic breach than initially believed

Equifax has said 2.5 million more Americans than initially believed may have been affected by the historic data breach, bringing the total tally of affected consumers to 145.5 million people. The credit reporting firm revealed in September that hackers swiped a trove of valuable data of millions of consumers in July including names, social security numbers, dates of birth, addresses, credit card numbers and other information.

Mandiant, a cybersecurity firm retained by Equifax to investigate the breach, found that 2.5 million more US consumers were potentially impacted by the massive breach. The firm did not identify any evidence of new or additional hacking activity or unauthorised access to new databases or tables, Equifax said in a statement on Monday (2 October).

"I was advised Sunday that the analysis of the number of consumers potentially impacted by the cybersecurity incident has been completed, and I directed that the results be promptly released," newly appointed interim CEO, Paulino do Rego Barros, Jr said. "Our priorities are transparency and improving support for consumers. I will continue to monitor our progress on a daily basis."

Equifax also noted that while it initially disclosed that data of about 100,000 Canadians may have been compromised in the breach, it has now revised that number to about 8,000 potential Canadian victims. The firm will notify all potentially impacted Canadian citizens via mail.

With regards to UK consumers impacted by the breach, the company said it is "continuing discussions with regulators in the United Kingdom regarding the scope of the company's consumer notifications as the analysis of the completed forensic investigation is completed".

"I want to apologise again to all impacted consumers," Barros said. "As this important phase of our work is now completed, we continue to take numerous steps to review and enhance our cybersecurity practices. We also continue to work closely with our internal team and outside advisors to implement and accelerate long-term security improvements."

Following the disclosure, Equifax has drawn fierce criticism from consumers and lawmakers. The company has since been slapped with a number of lawsuits and is facing probes from multiple US states, Congress and the Justice Department. The company has also come under fire after it was revealed that three executives sold almost $2m worth of company stock just days after the company found out about the attack, but before it was publicly disclosed.

Former CEO Richard Smith as well as the company's chief information officer and chief security officer have since retired. Smith is scheduled to testify on Capitol Hill this week before multiple Senate and House committees.