B. Good morning. The subcommittee on Digital Commerce and Consumer Protection will come to order. The chair now recognizes himself for five minutes for an Opening Statement. Good morning. Today we are here to get the facts to learn what happened at equifax that led to the personal information of over 143. Americans information being stolen. We must find out what happened. The public deserves to know what happened and what steps are being taken to protect their Sensitive Data Going Forward. Todays hearing needs to shed some much needed information and light on this breach. We have received ashursurances m equifax that mr. Smith can speak on concrete remediation steps that the company took in the aftermath to secure its Computer Systems and protect the affected u. S. Customers as well as what happened when he was chief executive. As chairman of the Digital Commerce and Consumer Protection subcommittee i often speak about the fact that we live in a digitally connected world. That fact of life can have implications far and wide ranging for commercial, communications and entertainment. The breach is a massive reminder of the bad actors out there and the security challenges confronting our data powered economy. In this case. Sensitive personal information that is used to build Credit History and allow individuals to engage in commerce, open credit cards, buy cellphones and appliances and secure mortgages has been compromised. Reasonable security measures must be implemented, practiced and continually improved by companies that collect and store data in order to guard against unauthorized access to sensitive personal information. Otherwise, consumers are face substantial financial harm. This risk is deeply concerning to me, and i know that the other members of the subcommittee share this view. Priority number one. We must protect americans and work to safeguard their personal information online. The recent equifax data breach is unprecedented and is also unique because of the sensitivity of the information stolen, including full ninedigit Social Security numbers, over 143 million americans are potentially impacted. This represents approximately 44 of the total u. S. Population. In my home state of ohio, approximately 5. 2 million customers are likely affected. Based on the information released by equifax we are informed that the massive amounts of personal and Financial Information was assessed from midmay through july 2017, including names, birth dates, addresses and in some cases drivers license information. In addition, over 200,000 people had their credit card information stolen and over 180,000 people had credit dispute documentation stolen. This is a Staggering Amount of sensitive personal information and impacts an extraordinary number of creditviable americans that is in the hands of criminals that could result in fraud or Identity Theft. We need these numbers confirmed. Today we must understand the following. First, how did the hackers get into equifaxs system for so many weeks and pull so much information out of the system without being detected . Second. What proses and procedures were in place in the event of a breach and were those processes followed . There are many questions as to who knew what and when this information was known. This will have implications and other ongoing investigations. Further, the chief Information Officer and chief Security Officer made retirement announcements shortly after the public announcements of the breach and have not been available for questions about their role. Again, despite months of delay, why was equifaxs notification and consumer production processes still met with misinformation, glitches and overall confusion. For example, there are numerous reports of difficulties assessing equifaxs dedicated website or call centers. And there were dismaying reports that the official equifax twitter account directed consumers to a fake website. I believe the American Public deserves to know the facts about when and how mr. Smith, company management, the board of directors, were made aware its systems were vulnerable to hackers and how over 143 million sensitive personal data records were stolen. To that end, what were the steps taken and in what time frame to notify and help individuals who were impacted. I look forward to getting these answers today and many more questions for the American People answered this morning. And at this time i will ask the gend gentle lady from illinois, the Ranking Member or five minutes for her Opening Statement. Thank you, mr. Chairman, for holding this hearing. The equifax data breach was massive in scale. 145. 5 million american victims as of yesterday. I would call it shocking, but is it really . We have these unregulated private, forprofit Credit Reporting agencies collecting detailed personal and Financial Information about American Consumers. Its a treasure trove for hackers. Consumers dont have a choice over what information equifax or, for example, transunion or experian have collected, stored and sold. If you want to participate in todays modern economy, if you want to get a credit card, rent an apartment, or even get a job often, than a Credit Reporting Agency may hold the key because consumers dont have a choice, we cant trust Credit Reporting agencies to selfregulate. Its not like when you get sick at a restaurant and decide not to go there anymore. Equifax collects your data whether you want to have it collected or not. If it has Incorrect Information about you, its really an arduous process. I have tried it, to get it corrected. When it comes to Information Security, you are at the mercy of whatever equifax decides is right and once your information is compromised the damage is ongoing. Given vast quantities of information and lack of accountability, a major breach at equifax, i would say, would be predictable, if not inevitable. I should really say breaches. This is the third major breach equifax has had in the past two years. From media reports and the subcommittees meeting with equifax after the breach its clear that the company lact appropriate policies around Data Security. This particular breach occurred when hackers exploited a known vulnerability that was not yet patched. It was months later before equifax first discovered the bleach and another several weeks before equifax shared news with the consumers, this committee, the federal trade commission and the Consumer Financial protection bureau. Senior officials at the company are saying they werent immediately aware that the breach occurred and, yet, by the way, there were executives who sold over a Million Dollars in stock just days after the breach was discovered, but yet not reported. And for a lot of americans, that just doesnt pass the smell test. The response to the breach was its own debacle. Equifax offered consumers Credit Monitoring Services that initially came with a mandatory arbitration clause, which fortunately has been corrected. Equifax tweeted links to the wrong url directing victims to a fake website. The call center was understaffed. In the end. Equifax has had to apologize for its postbreach response almost as much as it has apologized for the breach itself. Equifax deserves to be shamed in this hearing, but we should also ask what congress has done or failed to do to stop data breaches from occurring and what equifax plans to do the same day that Equifax Breach went public, the House Financial Services Committee Held a hearing on ficra liability harmony act, a bill to protect Credit Reporting agencies like equifax from classaction suits. Imagine. In fact, equifax was lobbying for this bill after the breach was discovered in july, still not reported, and the 14 republican sponsoring this bill should ask themselves were this is really the industry they want to be in bed with. Companies like equifax need more accountability, not less. I agree with the cfbd director richard cordray, that the Credit Reporting agencies need embedded regulators to protect consumers Sensitive Information. Then we need to go further. Last night i reintroduced the secure and protect americans data act, along with Ranking Member pallone and seven other members of the energy and commerce committee. And our bill would establish one strong Data Security standards, two, require prompt breach notification which we didnt get and, three, provide appropriate relief for breached victims. Chairman latta, American Consumers dont just need answers, they need action. I hope that our bill can be a starting point for discussion on strengthening protections for americans data. Consumers deserve a whole lot better than they got from equifax. And i yield back. Thank you. The gentle lady yields back. Chair recognizes the gentleman from oregon, the chairman of the full committee for five minutes. I thank the chairman. Were here to do today what it appears equifax failed to do over the last several months and thats put consumers first. Our job is to get answers for the more than 145 million americans who have had their personal information compromised and now fear they could be victims of fraud at any time. How could a major u. S. Company like equifax, which holds the most sensitive and personal data on americans, so let them down. Its like the guards at fort knox forgot to lock the doors and failed to notice the thieves were emptying the vaults. The American People deserve to know what went wrong. We want a clear time line of events and to understand what to expect moving forward. As chairman i have always tried to put consumers first on everything we do on Public Policy. Today well begin to get the answers for the public, hold equifax accountable and make clear that businesses hold the americas most Sensitive Data have a responsibility under existing laws to protect those data. Today gives whole new meaning to mr. Smith goes to washington. Its not a run on the bank thats at issue, its a run on financial records of 145 million americans. And the consequences and the inconveniences for fellow citizens is every bit as important to discuss today as the reasons behind why this breach occurred in the first place. Mr. Smith, as former chairman and ceo of equifax at the helm during and immediately after the breach, we appreciate your being here, and we expect your candor and full cooperation as we march toward getting the facts in this case. While there is no such thing as perfect security, companies do have a legal obligation to protect sensitive consumer data. This diligence is necessary to both comply with existing laws and maybe more importantly earn and keep the Publics Trust in a datadriven economy. Given the size of the breach and the sensitivity of the data we expect to learn more about how equifax failed to secure its systems and what contingency plans were in place. Further, we need to understand how information flowed through the organization and when you and other Senior Executives were notified about the breach. In other words how important was Cyber Security to you as the ceo and the rest of the executive team. D while there are still many questions that need answers, a few details have emerged. First, the vublnerability that the hackers used to get into the equifax system was discovered in early march. From the beginning the vulnerability was described as critical and easily exploitable. The information was pushed out through multiple security information sharing channels including by the u. S. Computer Emergency Readiness Team to equifaxs chief Security Officer. For some period of time between march and august of 2017, the hackers were able to sit on equifaxs system and siphon out 145 million records without being detected. How did this go unnoticed . Further, is there a process in place to raise flags or alarms when massive amounts of data are pulled out of the equifax system . Then there are questions about equifaxs response for consumers that we need answers to. Why was the consumer facing website created on a separate domain from the main equifax website . Did anyone raise concerns about creating more consumer confusion with a separate website . Are consumers able to sign up for the products offered by equifax today . How many consumers have placed a fraud alert on their account or frozen their credit . On top of all the other issues, multiple times equifax tweeted the wrong url, directing consumers to the wrong website to check if they were part of a breach. Talk about hamhadded handed responses this is unacceptable. I have to agree with the interim ceo when he said there is insufficient support for consumers. Its important that, as congress does its work on Public Policy issues, that the federal trade commission and other agencies, including Law Enforcement agencies, continue their work, especially in light of recent reports that indicated there are markers of nationstate activity involved with this hack. But today, mr. Smith, i and the rest of the committee and congress and the country expect the answers. After all, the buck does stop with you as ceo. And i thank you for being here. And i return the balance of my time. Thank you very much. The gentleman yields back. The chair now recognizes the gentleman from new jersey, the chairman or the Ranking Member of the full committee. Thank you, mr. Chairman. While i understand that Law Enforcement and internal investigations into this incident are still ongoing, i expect to get more information today on what happened and why it took so long to inform the public. Most importantly, we want answers for consumers because equifaxs response to this breach has been unacceptable. So too has been equifaxs ongoing lax attitude when it comes to protecting consumer data. Its been four weeks since the breach was made public and at least ten weeks since it was discovered by equifaxs employees, yet equifaxs Customer Service has been confusing and unhelpful. Equifax even tweeted a link to a fake website. Many of the remedies now offered to consumers were not offered up front or in good faith. They were forced out of the company only after public outcry and are still inadequate. Its hard to imagine that anyone at equifax thought it was a good idea to offer only one year of credit monitoring with an arbitration clause at first to boot. Free and comprehensive monitoring and Identity Theft protection should be offered for far longer than a year. Most recently equifax added lifetime credit locks to its offering, which consumer advocates suggest are weaker than credit freezes. Regardless, a lock or a freeze at only one Credit Bureau is almost useless. Equifax should work with the other Credit Bureaus to immediately create a free, quick and easytouse freeze and unfreeze, onestop shop. Because credit freezes or locks may not work for everyone, Going Forward equifax should do more than credit locks. It should give consumers more control over how their data is used and stored. In addition. If equifax wants to stay in business, its entire Corporate Culture needs to change to one that values security and transparency. After all, this is not equifaxs first data breach in the past year. Consumers do not have any say in whether or not the equifax collects and shares their data. And thats what makes this breach so concerning. This is unlike other breaches at stores such as target and michaels where consumers could make a choice and change their Shopping Habits if they were upset with how the companies protected data. Thats simply not the case with equifax. While data breaches have unfortunately become commonplace its long past time for congress, beginning with this committee, to act. Since at least 2005 this subcommittee has been considering data breach legislation but its never become law. And its time we change that. Yesterday Ranking Member schakowsky and i reintroduced the secure and protect americas data act. The bill would require enforceable. Robust Data Security practices and meaningful notice to consumers. It would give additional protections to consumers after a breach. Of course, breaches will continue to occur. But they occur more often when there is no accountability and no preventive meshurasures are place. We need to start somewhere. Mr. Smith, i read your oped in usa today last month and the sue ceos oped in the wall street journal last week. I appreciate that youre sorry but my question is what now. I yield back. I thank the committees leadership for organizing this important hearing. 145, 500,000, a million americans. 145. 5 Million People at risk because of equifaxs failure. Now, mr. Smith, the American People deserve answers, and i hope you are prepared to provide them. Not just about what caused the breach, but what equifax is doing to prevent this from happening again. And to ensure that those who were harmed are made whole. I worry that your job today is about damage control. To put a happy face on your firms disgraceful actions and then depart with a golden parachute. Unfortunately, if fraudsters destroy my constituents savings and Financial Futures there is no golden parachutes awaiting them. We have questions and its our expectation that you have concrete answers. We need to Work Together to hammer out real solutions. I recently took a step in that direction by introducing the freeze credit freeze the free credit freeze act to allow consumers to protect themselves by freezing and unfreezing their credit at no charge. It is unconscionable that equifax failed so spectacularly to protect peoples most sensitive personal data. Its even more reprehensible that the same Company Profits from the pain that they have caused. And i certainly hope that we can get some assurances from the committees leadership that we will have a markup and a hearing on legislation to address this mess. And i hope that that assurance can be given before the holidays of 2017. I yield back the balance of my time. Thank you very much. The gentleman yields back. And this concludes the our member Opening Statements. The chair would remind members that pursuant to Committee Rules all members Opening Statements will be made part of the record. Today we have mr. Richard smith, the former chairman and ceo of equifax, inc. , who is here to testify before the subcommittee. Hell have an opportunity to give an Opening Statement followed by a round of questions from the members. Mr. Smith, you are recognized for five minutes. Thank you. Thank you. The honorable members of the sxhit its an honor to be here before you today. My name is rick smith. For the last 12 years i have had the honor of being the ceo and the chairman of equifax. Earlier this week i submitted a written testimony which at this time i dont plan on going through any detail on that, but rather i am here today to explain to you, the american you and the American People how criminal hackers were able to steal personal information on over 145 million americans from our servers and, as importantly, to discuss with you today what the companys response was to that criminal hack. The criminal hack happened on my watch. And as ceo, i am ultimately responsible and i take full responsibility. I am here today to say to each and every person affected by this breach, i am truly and deeply sorry for what happened. I have talked to many consumers. I have read your letters. And equifax is committed to make it whole for you. Americans have a right to know how this happened. I have prepared to testify today about what i have learned and what i did about this incident. In my role as ceo and as chairman of the board. And also, what i know about the incident as a result of being briefed by the companys investigation which is ongoing. We know now that this criminal attack was made possible because of a combination of human error and technological error. The human error involved the failure to apply a Software Patch to our dispute portal in march of 2017. Technological error involved the scanner which failed to detect that vulnerability on that particular portal. Both errors have since been addressed. On july 29th, and july 30th, suspicious activity was detected and the team followed our security incident protocol. The Team Immediately shut down the portal and began our internal security investigation. On august 2nd, we hired top Cyber Security forensic and legal experts and at a time we notified the fbi. At that time, to be clear, we did not know the nature or the scope of the incident. It was not until late august that we concluded that we had experienced a major breach. Over the weeks leading up to september 7th, our team continued working around the clock to prepare. We took four steps to protect consumers. Step number one. Determining when and how to notify the public, relying on the advice of our experts that we needed to have a plan in place as soon as we announced. Step two, helping consumers by developing a website, staffing up massive call centers, and Offering Services free to every american. Three, preparing for increased cyb Cyber Attacks which we were advised by the Cyber Security experts that we should expect. And finally, continuing to coordinate with the fbi and their criminal investigation of the hackers. And also to notify other federal and state agencies. In the rollout of our remediation program, mistakes were made for which, again, i deeply apologize. I regret the frustration that Many Americans felt when our websites and call centers were overwhelmed in the early days. Its no excuse. But it certainly did not help that Hurricane Irma took down two of our larger call centers in the first few days after the breach. Since then, however, the company has dramatically increased its capacity, and i can report to you today that we have handled over 420 million consumer visits to our website in just over three weeks. And the weight times ait times centers have been substantially reduced. At my direction the Company Offered a broad package of services to all americans. In addition, we developed a new service, available on january 31st, 2018, that will give all consumers the power to control access to their credit data by allowing them to lock and unlock their credit files when they want. And they can do that for free, for life. Putting the power to control access to credit data in the hands of the American Consumer is a step forward. I look forward to discussing this new tool with you during my testimony. As we have all painfully learned, Data Security is a National Security problem. Putting the consumer in control of their credit data is a First Step Towards a longterm solution to the industry or the problem of Identity Theft, but no Single Company can solve a larger problem on its own. I believe we need a partnership to evaluate how to protect data Going Forward. I look forward to being a part of that dialogue. Chairman latta. Ranking member sta cowski. Thank you for inviting me to speak to you. I will close again by saying, again, how sorry i am for this breach. On a personal note. I want to thank the many hardworking and dedicated employees who have worked with me so tirelessly over the past 12 years at equifax. Equifax is a very good company with thousands of great people waking up every day trying to do what is right. I know theyll continue to work tirelessly as we have over the past two months to right the wrong. I am looking forward to answering your questions. Thank you. Thank you very much. This concludes our witness testimony. Well move into the question and answer portion of our hearing. I will begin with recognizing myself for five minutes. I remind the members to try to keep the fiveminute rule on questions in place. Youll hear the tapping. I will begin with the questioning. Mr. Smith, the time line of events is raising some red flags i would like to ask you about. According to your statement, the first time you heard about the breach in security was on july the 31st of 2017. Is that correct . Yes, congressman, that is correct. You first asked for a briefing about the breach on august the 15th. Is that correct . Yes. That is correct. The first time the board of directors was notified about the breach was august 24th. Is that correct . Full board . Congressman, on the 22nd of august i notified our presiding director at that time. The full board was briefed on the 24th, again on the 25th and subsequent meetings after that. You notified the public about the breach on september 7th, correct . That is correct. You state in your testimony that you began developing the remediation for consumers on august the 24th or the 25th. Why was there a tenday delay between you fiennding out that personal stolen had been likely stolen and beginning to develop the remediation plan. And do you think the tenday window was responsible to Start Talking about how to talk to the consumers. I understand the question. If i may go back to the time frame of the 31st. The 29th and 30th someone in security had detected what they deemed as suspicious activity. That is something that happens routinely around our business. On the 30th, bring down this particular portal. And they start their own internal investigation. As i had mentioned in my opening comments and my written testimony, on the 2nd of august they had engaged leading forensic experts, cyber experts and leading king spallingding Security Team. When you talk to forensics experts, they will tell you the complications of trying to understand where these criminals were, the footprints they had left, the inquiries they had made, its a cumbersome process. Thats why it took weeks before we had an indication for the breadth and the depth of the issue which brought us to the august 24th date you had mentioned. Lets back up to july 31st when you learned you were talking with the experts. And you testified you did not know that personal information had been stolen at that point. Did you ask anyone if personal information had been stolen when you found out about that breach . Congressman. On the 31st all i was told at a time was that security had noticed a Suspicious Movement of data out of an environment we call a dispute portal. It wasnt until later that they understood that was an actual dispute document. We have no indication on the 31st of july that there was any p. I. I. Information that was vulnerable. Again, not knowing if that information the personal information had been stolen at that time your company is built on data. At any point did you think it was important or somebody in the Company Start looking at if personal data had been stolen at that point . I can tell you we were working with the best Forensic Auditors in the business. They do this for a living. We had a great cyber team from King Spalding with us. It took them tame. At that time they didnt know if data had been compromised, ex fi filtrated or what the situation was. How did mr. Webb exactly tell you there had been a breach . Phone call, email, in pern . How did he notify you of the breach . Surfait was a facetoface b meag meeting on the 31st. He had just learned as well. The data was very fresh to him. The incident was described as an incident, not as a breach. Is that the normal way for this information, if there had been a breach at the company, to notify someone, for the cio to come and give a facetoface . At that time we had no indication it was a breach. It was a suspicious activity. Did you tell anyone else in Senior Management or other members of the board of directors about the breach at that time . Or was it just not until you told the on august the 22nd when you had the one call and the 24th before the rest of the board of directors . Did anyone else know about the breach. On july 31st we did not know it was a breach at that time. Suspicious activity only. The first notification to the board was the lead director on the 22nd of august, which followed in the chronology of events a meeting i had with our Cyber Security experts and our outside counsel, occurred on the 17th of august. Thats when the pirkcture was starting to develop. Thank you. Pli time has expired. I recognize the gentle lady from illinois, the Ranking Member, for five minutes. Thank you, mr. Chairman. Im going to get right to it. I wanted to ask some questions about john kelly, the chief leal officer who i understand is responsible for security at equifax or was at least at the time of the breach and its discovery. Is that correct . Thats correct. Mr. Kelly reports directly to you, the ceo, correct . Correct. So we were told that mr. Kelly was informed by the chief Security Officer the week of july 30th. Weve just been talking about that. This a Cyber Security incident. You mentioned that, had occurred. Is that correct. He was notified of suspicious s. W. I. F. Activity in a web portal. Our staff was told about mr. Kelly was informed at the same time that the incident might have compromised personally identifiable information. Is that correct . The only knowledge i have is he was notified on the 31st that there was suspicious activity in a consumer dispute portal. We were told that mr. Kelly then wrote a short memo to you regarding the incident. Is that correct . Correct, Congress Woman. In his email it said, some suspicious activity. Okay. Around that same time, three equifax executives sold over 1 million of equifax stock. Thats on august 1st and august 2nd. And its reported that mr. Kelly was ultimately responsible for approving those sales. Is it true that mr. Kelly, or one of his direct reports, would have been required to sign off on the stock sales . Yes. Mr. Kelly, who is our general counsel, owns the clearance process i have a lot of questions. So the answer is yes. He had to he was supposed to sign off. Yes. Did anyone of these three stu executives have knowledge the Cyber Security incident had occurred. To the best of my knowledge, no. When were they informed that the incident had occurred . I dont know exactly the date that they were informed, but they were not best of my knowledge they had no knowledge at the time they cleared their trades with general counsel. Do you know for sure that they didnt know . To the best of my knowledge they did not know. And mr. Kelly, who we were told knew of the breach and that it contained personal information and yet still approved the stock sale, is he still chief legal officer for equifax . Congresswoman, i come back to it again, he did not know it was a breach that it could have been a breach. All he knew at the time, is my understanding, is suspicious activity when he approved the sales. What the heck does suspicious mean. It could be a breach, right . It was deemed suspicious activity. We had no indication that p. I. I. Was in fact compromised at that time. We had no idea if data was ex filtrated at that time. I understand you agreed to forego your 2017 bonus which has been about 3 million for the past two years, correct . That is correct. Its been reported that youll still remain 18 million from pension benefits from equifax. Is that accurate . That is correct. Retiring, which is the category right now although the Company Maintains the right to change that designation, also means youll be free to sell your equifax stock, which is worth about 24 million . Is that correct . Congresswoman that calculation its hard to say. Its a complicated calculation. It depends on the total shareholder return at the time of the stocks vest. I have seen different estimates. Its hard to say what the number is. We wont know until the end of the year. Thats in addition to equifax stock you sold earlier this year for 19 million. Is that correct . That sounds correct. And according to one report you could be eligible for 22 million in performancebased compensation depending how equifax stock performs in the next three years. Is that right . Let me be very clear if i may, congresswoman. When i announced my retirement and thought it was best for the company to move forward with a new leader, i agreed to step down at that time with no further compensation. I agreed i should not get a bonus. I agreed it would be no severance. I asked for nothing beyond what i had already earned. I was just informed by staff that the chief Security Officer told the chief legal officer verbally that there was pii that, according to a call with staff yesterday, that actually there was a mention of the breach of personally identifiable information. The cso told yeah, told us in a call yesterday is what i just heard from staff. Congresswoman, i have no documentation, no insight, no knowledge that anyone in the company informed me or in that case the chief Security Officer or the chief general counsel that there was a breach on july 31st . Is that what you said . Yes. Oh, we didnt say a date, i am told. Our staff didnt say a date. Okay. Let me just say i am glad the fbi is looking into it. Many state attorneys general, the city of chicago has sued. So well probably get more information that way as well. Thank you. Thank you very much. The gentle ladys time expired. The chair now recognizes the chairman of the full committee, the gentleman from oregon, for five minutes. Thank you, mr. Chairman. Mr. Smith, thanks again for being here today. As you know this is a sample of a copy of an equifax Credit Report in my hand. It lists Social Security numbers, address, Credit History. Debts, all the sort of personal Financial Information. Its the lifeblood of equifax, right . I mean these data points are really, really important to what you do. As a company. Congressman, thats correct. Its a 3 billion company. Data on 820 million customers worldwide. Yet, it appears this breach happened because the company didnt know it was running Certain Software on its system, right, the apache struts software that had the patch requirement . Congressman, as i alluded to in my opening comments and written testimony, it was a human error and technology error that did not allow us to identify i think thats what were trying to get to here. If i understand it right your own Information Technology system did not tell the equifax Security Division that the apache struts software which contained the vulnerability that led to this breach was running on the equifax system. How did that happen . Congressman, the day after the notification came out, from c. E. R. T. S, the Security Team notified a wide range of people in the Technology Team who were responsible for then finding the patch finding the vulnerability, applying the patch, and then days later, as is typical protocol, to deploy a technology scanner to then go look for the vulnerability, find the vulnerability, if it found a vulnerability, knew it was not patched. Both the human deployment, the patch, and the scanning deployment, did not work. The protocol was followed. Okay. So then people ask us how does that happen. If, as a sophisticated a company as you headed is, with so much at risk, how does this happen . And, you know, we have colleagues that say were going to, you know, double the fines, triple the fines, put fines in, do all these things, but how does this happen when so much is at stake . I dont think we can pass a law that, excuse me for saying this, but fixes stupid. I cant fix stupid as a colleague of mine used to say. With so much at risk i have talked to other Software Companies and people in the space who say some companies have an Automated System that when a patch comes out it automatically gets installed. Thats not what you had, necessarily, right . I am unaware of an automatic patch. System we have in place is security gets notification, and its not uncommon to get notifications from Software Providers routinely, about vulnerabilities that are discovered. They follow the protocol which is to notify the appropriate people, within the time frame that the protocol called for. Unfortunately the human error was they did not find of the the of of of the patch. The human error piece you researchesed is that they didnt know the apache struts was running . Because thats what needed patching, right . Congressman, great question. If i may clarify. Please. Human error was the individual who was responsible for communicating in the organization to apply the patch did not. So does that mean that that individual knew that the software was there and it needed to be patched and did not communicate that to the team that does the patching . Is that the heart of the issue here . That is my understanding, sir. And there is no i was on a bank board for a while. We always had sort of doublechecks on everybody, right . Do you not have a doublecheck of some sort, an audit of some sort . Is there it seems like that was a single point. The doublecheck was the scanning device that was deployed a few days later. But did the scanning device was i dont know how that process works. Does it know you have that software, or do you have to tell it thats what youre scanning for . Its the latter. You have to tell it what its looking for. It scans the environment. The individual who didnt tell the i. T. Team, whatever, the Security Team, thats where the individual failed, was that the same person telling them wlo to look for . No. The scanner is deployed by the Security Team. I should clarify the rationale, the reason why the scanner, the technology piece, did not locate the vulnerability is still under investigation by outside counsel. All right. One final question. You have referenced this suspicious data, you referenced incident, American People think all of that is breach. How regularly did you have incidents or Suspicious Movement of data . Is this a routine thing that people, hey, we had another incident, another Suspicious Movement of data, or was this sort of outside normal operations . As you alluded to in your comments, we do have a lot of data. And our primary goal is to protect that data. And we have experienced millions of suspicious activity against our database any given year. But to the point that the head of your Security Team comes to you and says, hey, weve got another one . Oh, that is not uncommon. How often would that happen in the course of a week . That they would come to the ceo and say, heads up . I dont have a number for you congressman but its not uncommon. Its not uncommon for us to engage Forensic Audit firms. Its not uncommon for us to engage outside counsel to help us think things through when there is a suspicious activity. Its part of doing business in the business you alluded to. Thank you. I yield the balance of my time. The chair recognizes the Ranking Member of yields bank ad chair recognizes the gentleman from new jersey for five minutes. Thank you. Mr. Smith you testified on august 11th, you were informed hackers had stolen, quote, a large amount of consumers personal information in this incident. On august 17th, i guess a week later, you said in the speech, and i quote, a huge fuopportuni for equifax, a massive opportunity for us, unquote. Im looking for a number. At the time you gave that speech, roughly how many consumers did you believe had been compromised by the breach, if you could. Congressman, if i may clarify. I think you alluded to august 11th date. Then august 17th. August 11th i had no indication. I was not informed at that time. My notification was before the august 17th meeting. You alluded to a speech from the in the 17th you said fraud is a huge opportunity for equifax. Its a massive growing business for us. Im looking for a number. At the time roughly how many consumers did you believe had been compromised by the bleach. August 16th, on or about the date you talked about i gave a speech we did not how much data was compromised, what data was compromised. That story was still developing. That speech youre alluding to is a very common speech we have in communities. This happened to be at a university. We talked to them. At that time when i gave that speech, i did not know the size, the scope of the breach. All right. During your tenure at ex fax you expanded the business expanding and packaging data. In the speech, free data with gross margin of profit of about 90 is, and i quote, a pretty unique model. I get this unique model is a good deal for equifax but can you explain how its a good deal for consumers . Thank you, congressman. I think i understand the question. Our industry has been around for a number of years, as you know. In fact, equifax is a 118yearold company. Were part of federally regulated ecosystem that enables consumers to get access to credit when they want access to credit and hopefully the best rates available to them at the time. Were very vital to the flow of the economy, not just the u. S. But around the world. I want to turn to what equifax is turning to consumers in the wake of the speech. Free credit lock introduced next year. Were told free credit lock service could require consumers sharing, selling information it collects to third parties with whom the individual already has a business relationship for marketing or other purse. That is true . This product will be a web enabled, mobile enabled application that will allow a consumer at the time he or she if they decide they want access to credit, toggle on and toggle off that application to give the bank, credit card issue we are, auto lender access to their credit file to approve their loan. Well, by agreeing to use the equifaxs lock service, will consumers also be opting into additional Marketing Arrangements either via equifax or partners . Congressman, were trying to change the paradigm. What i mean is this will be an environment viewed as a service, a utility, not a product. No crossselling, upselling or any products available to the consumer. When they go to get and sign up for locked product, its a service to them. Thats the only product, service they will be able to get. Will equifax give consumers an easy and free method to choose not to share their data this way, even if the consumer already has a relationship with the party. Common, i envision as this evolves over time, the consumer will have an opportunity to invite into their world who they want to have access and who they do not. It will be their choice, their power, not ours, to mat decision. The interim ceo announced january 31st of 2018 equifax would make locking and unlocking of a persons Credit Report free forever. A Credit Report lock is already included in trusted id, premier and other Services Like credit monitoring and Identity Theft insurance. Will that still end after one year . Congressman, a couple of differences. Number one, the product we offer today for consumers protects the consumer at the same level of protection they would get january 31st. The difference is todays browser enabled product or service, 391st of january will be an application much simpler and easier for the consumer to use. The protection is largely the same. So they get this free service. They sign up for one year. At the end of one year effective january 31st, 2018, goes into the locked product. The difference between not expiring between the credit lock part of trusted id premier and credit locking tools that will be available in january, why not just extend the Freeze Program . Theres a difference between the freeze, which came to pass back in 2003, passed the law in 2004. That is now governed by state laws in all states, and its a cumbersome process for a consumer. In many cases some states require to you mail in your request for a freeze, and we must mail you a pin. So your ability to get access to credit hen you want credit is encumbered. A consumer could go to a car dealer or bank to get a credit card, forget the pin, go back home, ge the pin, mail the pin in. Its a cumbersome product. The lock product were offering today is a step forward. Lock product for the 31st of january is an even further step forward. My time has run out, mr. Chairman. Thank you very much. The time has expired. The chair recognizes chair emeritus of the full committee, the gentleman from texas for five minutes. Thank you, mr. Chairman. Since im not a member of the subcommittee, thank you for your courtesy allowing me to ask questions. Mr. Smith, whats the market value of equifax . Whats your Company Worth . Congressman, last time i checked, its somewhere close to 13 billion. 13 billion. Im told by my staff that this current this latest data breach was about 143 Million People. Is that right . We were informed yesterday from the company that is typical Forensic Audit there was some slight movement. The numbers adjusted, press release came out 145. 5. I appreciate your accuracy the there. But under current law youre basically required to alert each of those that their account has been hacked, but theres really no penalty unless there is some sort of a lawsuit filed and federal trade commission or state attorney general files a Class Action Lawsuit against your company. So youre really only youre just required to for the ninoti everybody and say so sorry, so sad. I understand that your company has to stay in business harks to make money, but it would seem to me you might pay more attention to security if you had to pay everybody whose account got hacked a couple thousand bucks or something. What would the industry reaction be to that if we passed a law that did that . Congressman, i understand your question. I think the path we were on when i was there and the company continued is the right path. Thats the path of allowing the consumers to control the power of who and when accesses their credit file Going Forward. The consumer cant control security of your system. That is true, sir. Your security people knew there was a problem. According to staff briefings that ive been a part of, they didnt act in a very expeditious fashion until the system had already been hacked. I mean, youre to be commended for being here. I dont think we subpoenaed you. I think you appeared voluntarily, which shows a commendable amount of integrity on your part. But im tired of almost every month theres another security breach, and we have to alert you. I checked my file to see if i was one of the ones that got breached, and i apparently i wasnt. I dont know how i escaped, i didnt get breached, but my staff person did. We looked at her reports last night. The amount of information thats collected is way beyond what you need to determine if shes creditworthy for a consumer loan. Basically her entire adult history going back 10 years. Everywhere she lived, name, date of birth, Social Security number, addresses, credit card, student loans, security clearance applications for federal employment, car insurance, even employment history of jobs that she worked when she was in high school. Thats not needed to determine whether shes worthy of getting a 5,000 credit card loan or something. Now its all netherworld of who hacked it. I cant speak for anybody myself but i think its time at the federal level to put some teeth into this and some sort of a per account payment. Again, i dont want to drive credit buyers out of business and all of that, but we could have this hearing every year from now on if we dont do something to change the current system. So i would youd go back to your peers and work with the security chairman member and figure out something to do that gives incentive to the industry to protect ourselves. The om way i know to do it is it some find their account hacked, a company thats large number, worth 113 billion would probably rather collect data and not collect as much data than have to come up here and appear and say were sorry. With that, mr. Chairman, thank you for your courtesy and i yield back. The gentleman yields back. The chair recognizes the gentleman from new mexico for five minutes. Thank you, mr. Chairman. Mr. Smith, there is a difference between a locked product and a freeze, correct . Those are two Different Things . Congressman, theres a process thats a little different. As far as the consumer and the protection that he or she would get from doing one versus the other is virtually, if not exactly the same. Virtually almost exactly is not the same. Are they different . Its the same. So your locked product is the same as a freeze . As far as the protection. Well get into that later. I appreciate that clarification. Will equifax be willing to pay for this freeze at ex perrian and transunion where the information was stolen. The freeze or the lock. You say they are the same. Right now we offer a free lock product, as, you know, for one year. A free Lifetime Product for life start january 1st, 2018. That extends to experian and transunion . No, sir. It does not. Let me repeat the question. Will equifax be willing to pay for that freeze for that lock at experian and transunion for consumers whose information was stolen by equifax. Congressman, the Company Comes out with what they feel is comprehensive five Different Service das with life lock. I would encourage, to be clear, i would encourage transunion and experian to do the same. Its time we change the paradigm, give the power back to the consumer to control who accesses his or her credit data. Im down to limited time. I apologize. Ill take that for a no, equifax will not pay for experian and transunion. Do you think pay for Identity Theft, false accounts, medical Identity Theft or do you commit to compensating any consumers who surf harm as a result of your breach. We take this seriously. I apologize again to the American Consumer. Weve offered a con comprehensive set of products for free. Mr. Smith, will those products make consumers whole. It will protect them Going Forward. Will it make them whole, yes or not . Its hard for me to tell if someone has been harmed so i cant answer the question. If someones credit has baseball stolen and someone opened a bunch of accounts, bought cell phones, credit cards, and they cant fix their history, they have been harmed. In that case will ex fax make that person whole . Congressman, as i said, i apologize. Weve offered them a comprehensive i want to go back to the line of question earlier, in august 11 in your prepared testimony you were aware of a large amount of consumer pii. August 15th, in your prepared testimony pii had been stolen. It appeared likely, requested a detailed briefing to make sure how much the company should proceed. You held meeting for the detailed investigation. You gave a speech also on the 17th about profiting off of fraud with these new markets. You shared with mr. Pollone you were not aware of pii being stolen. What is it . Congressman, on the 17th i had the full debrief of Forensic Auditors, outside counsel and my team. I was aware on the 15th theres been pii compromised. How much, the scope i appreciate that clarification. You were aware it was stolen, just not how much. I was not aware it was stolen. It says in your prepared testimony you were aware you asked for a detailed briefing to determine how the company should proceed. You werent aware pii was stolen on the 15th. Is that true or not true . 17th was the detailed review of when i learned about pii. Even at that time, which pii was stolen, was it not stolen . Those details came to life, congressman, for the first of august. Mr. Smith on august 15th, were you aware that there was pii that was stolen or not . August 15th. Regardless of the amount. Were you away of that . August 15th i was made aware hackers, crennel hackers got into the system and had pii information. We can revert to your prepared testimony. The other question i have that was working on, is chief john kelly still employed by you or equifax . Yes, he is. You were the ceo at the time that approved terms of retirement for david webb and susan maldean. Is it permanent or changed to fired for cause like yours. An investigation going on by the board at this time. Mr. Chairman, i know that my time has collapsed here, if you will. But theres an article in wgn tv that talks about equifax doing their own investigation spot three executives that sold their stock and profited. I just i guess they must have a pretty good Investigative Team there because between the press release that happened friday and whenever it came out and the story on sunday and today we have a revolution that those folks didnt know that this breach took place. I just hope we get to the bottom of this. Again, mr. Chairman, i hope we can be given assurance to the committee and American People this committee will have a markup and hearing with bills before the holidays to give American People consumers confidence again because this is a mess. Thank you, mr. Chairman. Thank you. The gentlemans time has expired. The chair now recognizes the gentleman from mississippi. The vice chairman of the subcommittee for five minutes. Thank you, mr. Chairman, mr. Smith. Thank you for being here to testify today. In your written testimony and in response to some of the chairmans questions, you stated that you were informed of suspicious activity on july the 31st by your chief Information Officer and went on to discuss that you said i certainly did not know that personal identifying information, pii, had been stolen or had any information on the scope of the attack. Did you ask him had there been any personal identifying information that had been obtained . Congressman, at that time i was informed it was a dispute portal document. Dispute portal document is something that typically houses if a consumer is disputing with us they paid off a utility bill. He or she may take a picture of the utility bill. At that time that was the conversation. Not to interrupt. But my question was did you ask if any pii had been accessed . No, i did not. Were you made aware at that point of the patch. No, sir, i was not. Hu had any meetings with your chief Information Officer or Security Department about any of this issue prior to july 31st . No, congressman, i did not. Hu had any meetings with him about any other security information during that time from march until july 31st . Yes. We would have routine meetings. Security reviews, i. T. Reviews. How obvious do you have those. Congressman practice would be at least quarterly. Why did you not have this discussion come up. Obviously thats more than a quarter. So how many meetings did you have between that time of march 8th until july 31st with your Security Team. Understand your question why didnt no, how many meetings did you have during that time mar 8th to july 31st. I dont have that information with me. If thats important we can get that. How many do you remember . Normally we would have i. T. Reviews at least quarterly and security revows at least quarterly. Then augment that on an as needed basis. With those meetings and time lines of march 8th to july 31st were covering into threequarters. Not a total of nine months but touch into threequarters of that year. At any point at any of that did you have any information about this going on . No, sir, i did not. In your testimony you indicate Security Department ran scans in march for vulnerability but failed to identify it. Can you explain how this is possible and why was there never any dation of anybody coming back and checking to see, okay, we have this identified information. There was a failure of someone on the team to identify this, that it was being used, the software was being used. Was there no one coming in to verify that . Do you have an outside person prior to the one you hired to look at this . Congressman, we get notifications routinely. The i. T. And Security Team do to apply applications. This individual, as i mentioned earlier, did not communicate to the right level to apply the patch. The followup was, as you mentioned you said this individual. Uhhuh. So you had one person responsible for this. The owner of the patch process. Theres information comes out broadpaced communication. Once they receive notification of a Software Company or in this case dhs they notify appropriate people. The individual that owns the patch process cascades that information. For everyone thats on your equifax team, is there anything more important than protecting pii of the consumers . No, sir. Would we identify that as number one responsibility of the company and everybody in your company . We have for years, sir, yes. So it just appears, obvious ly, the job wasnt done. We know that. Were trying to look at this. I know, too, it was equifax spokeswoman who said shortterm remediation steps and continued to implement and accelerate longterm security improvements as part of ongoing action toss help prevent this type of incident from happening again. We have 145. 5 Million People whose pii has been compromised. How many files do you have in the system . Worldwide . Yes, sir. I think some i mentioned earlier, public number out there over 800 someodd Million Consumers and 100 Million Companies roughly. You know this breach includes some from canada, some from the uk. Would that be fair to say even at this point . Congressman, point of clarification there. There was some data we had on 7,000 canadians in the u. S. So data was in the u. S. , same environment. We had some data on uk citizens also in the u. S. That piece is still you said investigation. My home state of mississippi has 3 Million People. 3 Million People. Almost 1. 4 million files have been breached in my state. If you take away people that are minors, who dont have a file yet, almost my entire state is going to be impacted. So this is a travesty, something that was preventible, we know. Saying we want to protect what goes forward doesnt bring us a lot of comfort today. Thank you and i yield back. The gentleman yields back. The chair now recognizes the gentleman from california for five minutes. Thank you very much. I thought i prepared for this committee but i have no Chicken Scratch notes. I dont know where to start. Mr. Smith, welcome to washington. Are you currently employed by equifax . No, sir. You are not. When you decided to come back this committee, were you specifically requested by name to come to this committee, by this committee or offered up by equifax as the representative of equifax to come and represent equifax before this committee. I believe i was asked specifically to come before the committee. By equifax or the committee. My understanding is by the committee. Okay. Apparently the committee asked for the ceo at the time. At that time you were still the ceo, but youre no longer the ceo. Did you inquire as to why the current ceo or interim ceo didnt come before this committee . I did not. But i felt personally as my obligation the bleach occurred under my watch. As i said in my written testimony, my oral testimony, i ultimately take that responsibility so i thought it was important i be here. Thank you. I get the picture. On august 31st july 31st, you were notified of the suspicious activity that eventually, as we now know, is 145 million person breach. Was it july 31st, was it . A breach interaction. Verbal interaction. You referenced as an answer to another one of my colleagues questions on august 31st you received some kind of email referring to the possible breach . Point of clarification. I was notified on the 31st of july by the chief Information Officer, dave webb, in a very brief interaction that this portal seemed to have a suspicious incident. There was a communication trail internally between others also referenced i was aware of this incident through a minor that written trail was not mentioned to you. You were just mentioned in that trail you had been verbally notified. Thats my recollection. Mr. Chairman, is it appropriate for this committee to ask for that trail of documents . Ask the counsel. If its appropriate. Ask this committee to receive that trail thats been referenced on this committee, this congressional committee. Its come to my attention that several people are no longer with the corporation. Youre not officially with the corporation anymore. Cio at that time is no longer the cio of the corporation, of equifax. Thats correct. Theres another higher up that is no longer. The chief Security Officer. Chief Security Officer. However, the then conkelly chief legal officer was the chief local officer at that time but still is colonel the chief legal officer, correct nf that is correct. Apparently the chief legal officer on or about between july 29th and august 1st went to outside counsel and hired outside counsel, correct. No. It occurred august 7th, the chief Security Officer reached out to cyber expert and outside counsel, spaulding, and she engaged them at that time. Thank you. When executives at equifax want to sell stock, they need to get chief legal officer to sign off . Yes, correct, congressman. As a protocol, that requires the general counsel of equifax to approve that sale. And john gamble, joseph lundgren, potter, they are all high ups with equifax, they apparently sold stock on or about august 1st or 2nd in the amount of approximately 1. 8 million, give or take. So they had to get an okay from john kelly before they did that, correct . Thats correct, sir. Apparently they did get the okay . Yes, thats my understanding. You were the ceo at the time they sold the stock. I have no i get it. Im referring to but you were the ceo at the time. Thank you, mr. Chairman, just a little latitude on my time, what i would like to request from you and the Ranking Member that we can for some of hearing of this committee where we get john kelly chief legal officer, then chief legal officer of equifax and currently still chief legal officer hopefully when and if we get him here sehell still have the title. Im concerned congress having a hearing and equifax has before us someone who no longer works for them. I hope we can ask for that hearing where we have john kelly chief legal officer before us. Thank you. The chair recognizes former chair of the full committee the gentleman from michigan for five minutes. Thank you, mr. Chairman. Mr. Smith, every family watches over their Financial Data with grave concern. It impacts their daily life. Whether a mortgage, a loan, a c car, they have to have that credit score that gets often a job. They view that data as it relates to them as very, very private. And they want it to be secure. Here is an equifax Credit Report for somebody i know. Its 131 long. Unbelievable the Data Collected on this particular individual. I would guess most individuals have no clue theres that much data assembled on their own personal family account. You said earlier that the data was compromised. The question i have to ask is does that word compromise include the word or term manipulated . Are those folks who broke into that account, are they able to actually change the accurate data that might be reflective of their own personal story . Could that be changed . Congressman, i understand your question. The database was attacked by criminals. That we know. Forensic experts we engaged has led taos believe theres no indication the data left behind has been manipulated. Now, one of the things in this report, any Credit Report, you verify the income of that individual to make sure its accurate. As i understand it, and i good again personal experience, when one goes to get a loan, whether its a mortgage or a car, often one of those little boxes that you check, you are allowing permission to look at that tax return of the individual. Is that not correct . Regardless of selfemployed income, underwriting findings when used for documentation required, most recent two years of their individual federal tax reform, returns with all schedules in k2s and 1s, most two years business returns irs forms 1120, 1120s, 1065 which ownership interest of 25 or more and a complete and signed irs form 4506t is required for every borrower on their loan application, validated by irs required for each year documented in the loan file. So the question is if that is collected, is someone a bad actor actually able to use the personal information stolen from this report to then perhaps file a false tax return come the first of the year. Congressman, i think i understand your question, couple of points of clarification. Credit report does this contain employment and income information. There are many lenders who will ask you as a consumer going to get a loan validate your income, alluded to in readings how you might do that. The Credit Report does not contain employment income data. Number two, the unfortunate criminal hack that we refer to this morning, written testimony and press release for the past month or so was clear to say it did not include Credit Report information you just picked up there. It was limited to nonetheless a large number, but limited to an environment we call a consumer dispute portal, not the credit file itself. Last question i have is how did you know . How weve had a lot of hearings, a number of them classified. Breaches made Spot Department of energy, utility, a whole different Major Players where hackers are coming in trying to break and penetrate daily. What tripped these guys up . What was the how did you identify that, in fact, a breach had been made . What was their mistake . Congressman, theres a piece of technology called a decrypter, and there was a did he crypter that allowed us to see some of the data. Once we saw the data, thats what the start of the conversation earlier in the testimony here, thats when we saw the suspicious data and were able to shut off the portal at the end of july. Yield back. My time has expired. Thank you very much. The gentleman yields back and the chair recognizes the gentlelady from michigan for five minutes. Thank you, mr. Chairman. Mr. Smith, i first want to say we appreciate your coming in to testify today. We spent a lot of time talking today about the what, the when, the where, and the whys of this breach. I agree with all of my colleagues that we need to be expressing extreme displeasure, but i want to ask a few questions about where we go from here because i hockey this has awoken american consciousness about privacy and credit they need to be paying far more attention to. This breach is different than most. Not only the scale of those affected by the type of information taken. In the past folks usually just changed your passwords, maybe you get a new credit card and that was it. It was an annoyance but had no real impact on your life. Thats not so simple when its your Social Security number or other personal information. You cant change your Social Security number and i cant change my mothers maiden name. This data is out there forever. Clearly something needs to be done. We can all sit here and talk about what went wrong but we are doing the public a disservice to not at least begin the discussion on how to improve Data Security. Thats why i am a proud cosponsor of the bill, its a good first step that needs to be given serious consideration. Im also introducing data production of 2017. Whatever path going forth, its important we tea action on the topic and all American Consumers pay attention. Id like to ask a few questions. Nobody has asked this question yet. Just a quick yes or no. Have you or anyone on your team seen signs that the attackers were backed by a nation state . Congresswoman, weve engaged the fbi. At this point thats all ill say. I dont think its all the same but thank you. After your Security Department blocked suspicious traffic you mentioned in your testimony, did anyone from your team or outside Companies Venture beyond the perimeter of your network to attempt to locate where they came from . Yes we had the ability to track the ip address of the criminals. As, you know, finding the ip address doesnt necessarily tell you where they are from. Its easy to set up ip addresses all around the world. I want to move to this other topic. I share your belief accessing credit data should be placed in the hands of the consumer but most people have no idea equifax was holding their data. I unfortunately learned a long time ago. This wasnt the first data theft and doris and i were part of something elsewhere they got our Social Security numbers and mothers maiden names. Its one thing to take steps to mitigate damage after a breach has occurred. Going forward we must give consumers a chance to protect themselves before a breach happens. Do you believe consumers can take reasonable steps to secure their identity and information if they dont even know who has it . Congresswoman, i think we can help. I think we can help by the announcement offering to all americans the ability to lock and unlock your credit file for life for free. There needs to be greater awareness. I understand your point clearly. I think by making this available to all americans, its one step in doing that. So i was just actually even educating my colleagues up here about credit karma, and they were stunned by how easy it was with two little factoids to suddenly unleash the money they had on every one of their credit card companies, what any data inquiries have been in all of the different factors. I think most people dont understand that its not just you but experian and transunion who are also collecting this data. Why do consumers have to pay you to access their Credit Report . Why should that data not be free . Congresswoman, the consumer has the ability to access the Credit Report for free, from each of the free Credit Reporting agencies each year. You combine that with the ability to lock your credit file for life for free. Again as a step forward. Well, im running out of time. But like my colleague over here, when you find mistakes, which a number of us have, and were luckier than 99. 9, its very difficult to fix. When you do fix it, you still have to pay. I think we need a longer debate about who owns this data and how we educate the American People. Thank you, mr. Chairman. The gentleladys time is expired. The chair recognizes the gentleman from new jersey for five minutes. Thank you, mr. Chairman. Good morning to you, mr. Smith. Criminals perpetrated this fraud. Is it possible these criminals are from another country . Congressman, its possible. But at this time its possible. Number two, is it possible its the government of another country . As i mentioned to the congresswoman a few minutes ago, weve engaged the fbi, they will make that conclusion. Do you have any suspicions in that regard, either persons electric other countries or the government of another country . Congressman, at this time ill defer that. We have the fbi involved . Yes, noi we have the fbi involved. Do you have the opinion to the two questions i just asked . I have no opinion. You have no opinion. The stock that was sold by your colleagues, mr. Gamble, mr. Lockrin, mr. Plodder, as i understand that stock was sold august 2nd. Is it usual executives of a mature company, not a company thats just come onto an exchange, is it usual that the significant amounts of stock are sold. Congressman, a few points of clarification, stocks sold first and second. I said the second. The first was the first day it was sold. Yes. Not unusual for stock to be sold at the end of a quarter, a window opens up and we encourage those who are going to sell to sell as early in the window. The windows is open 30 days. The sell is early, its possible, and thats what occurred here. You believe this stock was sold merely as a matter of course as would be true in any other quarter . Yes. You do not believe it was based upon knowledge known by these gentlemen related to the breach. Congressman, ive known these individuals some up to 12 years they are honorable, men of integri integrity, followed due process, went through the processs counsel, i had no indication they had any knowledge of the breach at the time of the sale. Did you have knowledge of the breach at that time . I did not, sir. Werent you warned in advance of this that there was suspicious activity . I was notified july 31st and conversation with chief Information Officer that there was suspicious activity detected in an environment called the web portal consumer dispute. No indication of a breach. That was prior to the sale of the stock. Is that accurate . 31st of july. Theres no indication of a breach at that time. From my perspective as a layman, the difference between a breach and suspicious activity is not one that i believe is particularly relevant. A breach might have technical connotations to it, but certainly you were aware of untoward activity prior to that date. Is that accurate . No, congressman, it is not. On the 31st we had no indication the documents were taken out of the system, what information was included. It was very early days. It took the forensic experts, as i mentioned earlier, from then to the 24th to develop a clear picture. That picture has still changed, the 24th, as we heard just last night, the additional announcement. Many calls have been received by equifax at your call center since september 7th. Do you know how many calls have been dropped or missed due to staffing extortages or other issues. Congressman, i dont have the exact number. As i said in my opening testimony i apologize for that startup. It was overwhelming in volume, overwhelming. I think i mentioned over 400 million u. S. Consumers coming to a website in three weeks. We went live in a very short period of time with call centers. Our two larger call centers were taken down in the first two days by hurricane maria. The team is committed, was committed to make the experience better for the consumer. Im told each and every day that the process is getting better. August 22nd, you notified a lead director, mr. Fiedler, i hope im pronouncing that right, of the data breach. The full board was informed later, two days later. Why was there nearly a week between august 17th and august 22nd before members of the board were alerted. Congressman, the picture was very fluid. Fluid. Fluid. What does that mean . Were learning new pieces of information each and every day. As soon as we thought we had information that was of value to the board, i reached out to the director, as you said, art fiedler on the 22nd, Board Meeting on the 25th, had subsequent Board Meetings routinely, if not daily, in some cases as close as last week. Thank you. My time has expired. Thank you. The gentlemans time has expired. Recognize the gentlelady from california for five minutes. Thank you for appearing here today. As many of my colleagues highlighted events that led to the data breach and actions equifax management took after the fact are very upsetting. It seems Many Americans are in a place of breach fatigue. This latest event that nearly impacts half of all americans should light a fire under every Single Member here. I think you noticed it has lit a fire. We cannot follow the same script after the next inevitable data breach. Thats why im supporting swom schakowsky secure americans data act. Its not like this type of legislation is unprecedented. 48 states implemented laws that require consumers to be notified of security breaches. Im pleased that my home state of california was the first state to pass this kind of notification law in 2002. Today if california residents personal data is hacked state law requires they are notified in the most expedient time possible and without unreasonable delay. We nus ensure all americans are subject to protections like this at the federal level. Mr. Smith, because equifax without doubt has information that many california residents, the company is subject to california data breach law. Can you please describe to me how equifax complied with the state law. Were california residents notified of the breach as required. Congresswoman, i dont have specific knowledge of the california law. I can tell you, though, that we worked as a team, including with our counsel, to help us ensure what were doing is right for the consumer in the most expedient possible. Were aware of the requirements for the different state laws. I just dont have specific knowledge as it relates to the state of california. So you also dont know because the laws require equifax to submit a copy of the breach notification to the California Attorney general, you dont know where this was done . Congresswoman, i do not, but we can have our team follow up with your staff, if that would be helpful. Okay. In the context of this breach, if data that you hold is about me, do i own it . Do i own my data . Could you please repeat the question . In the context of this breach, if the data that you hold is about me, do i own it . Congresswoman, we are part of federally regulated ecosystem thats been around for a long time, and its there to help consumers get access with their consent to credit when they want access to credit. Well, can you explain what makes data about me mine compared to what makes it someone els . The intent, if you will, of the solution weve recommended we implement and going live with in january of 2018 is, in fact, to give you, as the consumer, this lock product for life for free, the ability to control who accesses your personal information and who does not. So at that point in time you believe that i own i can say i own my data. Is that right . Youll have the ability to control who accesses and when they access your data. Okay. Could i ask you some further questions following along to what others have asked about credit locks and credit freezes . Now, limiting access to credit even for a short amount of time can have real financial consequences especially for low income populations. How quickly will a file be able to be locked and unlocked and how will you ensure that speed . Congresswoman, thank you for that question. That is a great advantage of the product were offing for free versus the freeze, which was, again, came about in 2004, a regulation. There are states dictate how quickly you get access to freezing and unfreezing your file. Oftentimes that can take days if not weeks because were mailing data back and forth to the consumer. In this case the intent is in january 2018, on your iphone, you can freeze and unfreeze your file instantly at the point you want it locked and unlocked. So i recall that one of my colleagues asked whether a credit lock was the same thing as a credit freeze and you said it was. Is that correct . As far as protection to the consumer, congresswoman, it is. As far as the ability to lock or unlock or freeze and unfreeze, a lock is far more user friendly. Okay. So you currently offer a credit lock product now. And you plan to offer this other one for free starting the end of january. And can you describe for me why you consider that. Would a lock be more economical for you, or would a freeze be . Im trying to get the sense of the difference. I think there is a difference here. If i may, one more time to try to clarify, as far as protection are the same. The lock youre getting that we offer to consumers on september 7th gives you the same level of security you would get from a freeze or from the product thats going out in july january. The difference is todays lock is browser enabled. Januarys lock will be an app on iphone. Secondly, instant on, instant off versus freeze or todays lock. Ive got more question but ive run out of time. Thank you. Thank you very much. The gentleman from illinois is recognized for five minutes. Thank you, mr. Chairman. And thank you for being here today. This is 145 1 2 Million People affected by this data breach, nearly half of americans. Its a failure on all levels a failure to keep Consumer Information secure. A failure to respond to the preach and a failure to respond to the public and much more. My constituents and American People want answers. They what want assurances they are not going to be financially ruined by this. I want to make a point, you were asked if people harmed by this would be made whole. You made a statement and i understand theres probably legal and technical reasons and you said, i dont know if consumers were harmed. I just want to make it a point that i think that idea that people are not harmed in this is ludicro ludicrous, of course they are harmed, even if theres no financial harm, just having information exposed is a huge deal. I fear were going to see bigger repercussions than that. I was surprised equifax had a requirement consumers submit to mandatory arbitration clause. Why did that happen . Why was at the beginning part of the rollout . Congressman, thank you for that question. I want to clarify. The product offer that went live on the 7th, it was never intended to have that arbitration clause apply to the breach. It was a standard boilerplate clause as a part of the product. As soon as we learned the boilerplate term was applied to this free service, i think it was within 24 hours. We removed that and tried to clarify it. That was a miss attachment one of the mistakes i alluded to more oral testimony, remediation on the 7th. Does equifax require consumers to commit to arbitration with respect to other products . If not, is that information prominently disclosed to the consumer. Not as it relates to the breach, congressman. The question is what other products do you require arbitration. Some of the Consumer Products we have theres an arbitration clause in there, standard claw. Whats the reason for that . I dont have that answer other than its a standard clause. If you could get that to me, that would be good. Your press release shows your Company Found no unauthorized activity on equifax core consumer data, reporting databases. What are they and how are they distinct from the databases containing information subject to the unauthorized theft . Congressman, the area that was impacted here was a consumer dispute portal for consumers who come in and dispute activity with us. Its separate, a congressman talked about credit file on their hand. Separate from the core credit data consumers have in our database. So in essence were there 145. 5 Million People at one point had disputed credit issues then, if that was the its the portal they used. They could have been in that portal for multiple reasons. We also by regulation have to keep data for extended periods of time. In some cases seven plus years. So its a lot of data for a lot of years. Outside of the core credit file itself. Which Company Databases were accessed . Why wouldnt you consider that . Maybe this is a change. Why wouldnt you consider that to be part of the core consumer databases. The way we define it. The credit file itself is housed in a completely separate environment from a database consumers come into directly. The core credit file itself is largely actioned by companies we deal with versus consumers. So i just want to make sure. You have to forgive me im not an i. T. Expert. To get 145 Million Peoples records in only the dispute database, i guess im trying to figure out if you didnt really answer the question in terms of were there 145 Million People disputed, half of americans, or another entry that went into that that went into other information. Maybe i dont understand the i. T. Part of this. The only entry was the consumer dispute portal. That is a completely separate environment from the credit file itself. We also, as you might recall, has a lot of data for Small Businesses in america. That environment part of the definition youre alluding to was not compromised either. Lastly, are your core consumer or commercial Credit Reporting databases encrypted . We use many techniques to protect data. Encryption, tokenization, masking, encryption in motion, encrypting at rust. To be specific this wasnt encrypted at rust. This wasnt but your core is . Some, not all. Some data is encrypted, some tokenized, varg levels of security techniques the team deploys different environments around the business. Thank you. I yield back. Thank you. Yields back. The chair recognizes the gentleman from california for five minutes. I thank the chair for holding this hearing. Mr. Smith, my understanding compromise information due to unpatched vulnerability and framework apache struts. So as the companys Online Consumer dispute resolution portal, does equifax have any other portals that use apache struts . No, sir. This was the environment that deployed struts. All right. That was a simple answer. We might to restart my time. In addition to equifaxs credit monitoring and reporting services the company has equifax for business offerings. In this capacity operates as data broker. As part of these services, the company collects large amounts of data about consumers without consumers having any knowledge of this happening. Was this information compromised in the breach . I think i understand the question. Could you repeat that one more time, please, to get it right . Youre familiar with the equifax for business offerings. Yes. We do have Product Offerings and solutions for Small Businesses, medium sized businesses and Large Businesses across the country, correct . Equifax for business also compromised in the breach . No, congressman, it was not. Goes back to the question what we call core credit data. It was not compromised. In your testimony throughout my tenure as ceo of equifax, we took Data Security and privacy extremely seriously and devoted substantial resources to it. Would you tell about what investments equifax made in Cyber Security during your tenure. Yes, congressman. When i came to the company 12 years ago, i had virtually no focus on Cyber Security. At that time Cyber Security was not as sophisticated as it is today. Weve gone from that environment to a team now of over 225 professionals focusing each and every day on security around the world. So what timeframe is that . That was from the time i started 12 years ago. So you said you hired up to 250 personal i didnt hire them, sir. 225 y experts around the world. We have made substantial investments over that timeframe. In the last three years ago, we have invested approaching a quarter billion dollars in security. Theres an ibm benchmark that says Financial Services companies tend to be best in class, spend somewhere between 10 and 14 of their i. T. Budget on security. The company was notified of the vulnerability in the apache struts system days before the attack occurred. Yes, we were notified boo the department of Homeland Security in march of 2017. And the attack occurred after the notification. Yes. So was there a human failure . How could 250 professionals that are designed, hired for that purpose let a breach like that happen after they were notified . Yes, congressman, what happened, it was in my oral testimony, was the notification comes out. We had a communication process in place. I described it as a human error. Where an individual did not insure communication got to the right person to manually patch the application. That was subsequently followed by a technological error where a piece of equipment we use, which scans the environment looking for that vulnerability, did not find it. In your opening testimony. That seems like a lack of competence or professional error of some kind. Would you call it i described it as a human error and a technology error, and i apologize for that, but that is what happened. Okay, moving on. Do you believe that the ftc has an Important Role in protecting consumers from future data breaches . How much of the role should the ftc be playing at this point given whats happened . I think theres a role for the business to do more, the industry to do more. We talked about it earlier this concept of offering the consumer the ability to control their data. And lock and unlock when he or she so chooses. If theres particular legislation that arises out of this horrific breach, im sure you would find the manager of equifax and the industry willing to work and cooperate with the regulators. The reason im asking is the federal trade commission is an enforcement body but it doesnt have any rule making authority. Do you think the ftc should have rule making authority, do you think it would make a difference in the poirn, or do you have an opinion . I have no opinion. My final question is how long will individuals be vulnerable to Identity Theft problems due to this breach . We, congressman, offered five different individual services, as you may or may not be aware in september. One is the ability to monitor your credit files from all three of us for free. Another is to lock your file. Another is a dark that doesnt answer my question. How long are we going to be vulnerable . Our Social Security numbers are out there. This is forever, right . Unfortunately, the number of breaches of our Social Security number has been on the rise, as you know, and many even this year. So theres another thought, do we think about how secure really is an ssn and is that the best identifier for consumers Going Forward. Thank you, mr. Chairman. Thank you very much. The gentlemans time has expired and the chair now recognizes the gentleman from kentucky for five minutes. Thank you, mr. Chairman. Thank you for being here, mr. Smith. We appreciate you being here to testify. Theres a medical hearing going on upstairs so i have been back and forth, so im trying not to double a question, and when i was here earlier, a lot of us wondered, july 31st was the suspicious activity and then it seemed the activity and the notice to the board was three weeks later, august 24th to 25th. Not to repeat before, i know i heard you say it was suspicious activity and therefore you didnt realize it was a breach and the action took place three weeks later when you did. Looking back now on how colossal it is and how big it is, would you have done different . From july 31st to august 24th, what would you have done different than equifax didnt do . Thats an appropriate question. To be honest, time for reflection will come. Theres been no time for reflection. This has been a team of people, including myself, working around the clock for the last six to eight weeks trying to understand the forensics, trying as best we could to stand up an environment to offer Consumers Services to protect themselves. There will be an opportunity where ill have the time to catch my breath and reflect, but i have not had a chance to do so. Ia appreciate that. 1. 9 million kentuckians were exposed by this hack, and one of the questions we have about the process of equifax underwent to determine to help people determine that, and one was setting up a new website, not just a portal within your website, for consumers to visit. Was that an appropriate response . I know there were issues with getting onto the website, and the question is, were you part of the deliberation . Why did you choose to set up a new website that seemed to cause issues as opposed to doing a portal on your current website . Good question. It was strictly due to the sheer volume of incoming visitors that we had expected. The traditional website that we have use to interact with Consumers Services a total of maybe 700,000, 800,000 consumers at any one given point and time over a period of time. I mentioned in my opening comments earlier, this new microside as we call it, that we set up, had a capacity to surge to much higher levels. We had some 400 and i think 20 Million Consumers come to visit us in the first three weeks on that website. Our traditional equifax website could not have handled that volume day one. Okay. According to reports, many consumers were unable to determine with certainty if their information was breached, so why was equifax unable to provide clarity or certainty on if their information was breached . When you went to the website, you typed in six of your nine digits of your Social Security number. If it was likely that you were breached, it would Say Something along the lines of, it looks like you may have been compromised or breached as opposed to definitely you have been breached. Thats because its six versus nine. The point is we offer this service, its five Different Services, to every american. Didnt matter if you were compromised or not. Every american was offered the same services. So and just Going Forward, because we have to also do an analysis, and so what were going to do as a legislative body Going Forward to protect the American People. And what your business does and what the people in your business do are important. Its when you can sit down at a car dealer, i think you mentioned earlier, walk away a that afternoon because someone can check that youre credit worthy. Having those types of services available. So what steps is equifax doing to rebuild the confidence . People arent confident that their information is floating out there, but the ability to be able to access credit almost immediately if you have the proper credit, is something that your services provide, but the risk is having all that information in one place plus the convenience of what your type business sold, so how can people be confident this can go forward . Thats a really good question. Were a 118yearold company. We have done a lot of great things for consumers over this 118 years. We take being a trusted steward seriously. Step one is to make sure we think more holistically, broadly about steps we can and have taken to make sure were more secure today than at the time of the breach. The second thing is offer the services to consumers. We offered on september 7th to make sure theyre protected. And third is to launch this whole paradigm shift effective january ofthex year which is put the power and the control of the Consumer Credit in the consumers hands, not our hands. Thank you. And that would be helpful. I appreciate that. My time has expired. I yield back. Thank you very much. The gentlemans time has expired. Pursuant to Committee Rules, well go with the members on the subcommittee by order of appearance and then after that, the nonsubcommittee members. The chair will recognize the gentleman from florida for five minutes. Thank you, mr. Chairman. I appreciate it. Mr. Smith, one of my constituents accessed equifaxs website, equifaxsecurity2017. Com to determine if they were effected. They inform me that whether you submit your own identifying information or whether you submit a random name and Social Security number, you get the same message that you may be affected. What course of action should consumers who havent received correspondence yet as to whether theyre effected or not, what is the course of action, and if they were affected, what are the next steps . Congressman, its my understanding that those have gone online to register and that were not notified immediately, that that backlog is completely now drained, if you will. So if you are trying to sign up for the service, i understand your question correctly, you have now been notified. Okay. I understand that equifax currently is waiving fees to freeze and unfreeze your credit. How long is that exemption going to stay in place because its so very important . It is important, congressman. We have announced september 7th the ability to lock and unlock your file at equifax for free. For one year from the time you sign up. We have also announced on a product we have been working on for quite some time effective in january of 2018, the ability to lock and unlock your file with equifax for life for free. That will be the next generation of the lock that we offered in september. Okay. As ceo, what level of involvement did you have with regard to the Data Security and Data Protection . Yes obviously, the buck stops with you. I understand that, but what level of involvement did you have . So Data Security reported to a direct report of mine, my general counsel. And i would have active involvement with my general counsel, with the head of security, routinely throughout the year. Okay. What responsibilities did ms. Mullven, again, the chief Security Officer at equifax at the time of the breach, have with respect to Data Security, Data Protection, and data breach notification . What were her responsibilities . Those were a quarter of her responsibilities. She was the head of cybersecurity and physical security in all 24 countries that we operate. How many briefings did you have with ms. Mullven between march 8th and july 29th of 2017 . How many briefings . I dont recall. The congressman asked earlier, routine meetings which we go through security strategy, security quarterly reviews, Investment Decisions required for security. The actual number of times in that timeframe, i dont recall. Okay, so say half a dozen . A dozen . That would be a guess. It would be a guess. More than three . If its important to you, congressman, we can find that information. Give me that information. I appreciate that. What responsibilities did mr. Webb, the chief Information Officer at equifax at the time of the breach, have with respect to Data Security, Data Protection, and data breach notification . Directly none, sir. He was expected obviously as the head of technology to work closely with the head of security, but the security function is a separate function. You cant do security without i. T. You cant do i. T. Without security. How many briefings did you have with mr. Webb, again, between march 8th and july 27th of 2016 . If i may just clarify again, on march 8th is when the sert came out saying there was a vulnerability in apache struts. I was not even notified. To put in perspective there was an incident. Didnt know what the incident was until july 31st. So a number of meetings i would have with dave webb would not have been related to this incident. All right, mr. Chairman. I yield back. Thank you very much. The gentleman yields back. And the chair recognizes the gentleman from indiana for five minutes. Thank you, mr. Chairman. Thank you for being here. And again, i was at the Health Subcommittee hearing too so im back and forth. Sorry about that. But is it possible people who never signed up or used equifax directly could have been impacted by the breach . Yes, congressman. Okay. So how does equifax get the information on people who have never directly associated with equifax . Im not familiar with that. We get it from banks, telecommunications companies, credit card issuers. So on and so forth. Just like, you know, we go to apply for a loan. They send you the information because they want to get the data. They want to get the information on my credit rating, for example . Correct. As i define it, were part of the federally regulated eco system that allows banks its up to banks to notify the individual which credit agencies theyre utilizing to assess their credit risk . Or is it up to the credit traditionally, the contributors to the data, in that case, congressman, the banks would give their data all three of us the benefit of the system as you get a holistic view of an individuals credit risk. My point is, i guess, because a lot of people i talk to back in indiana, southern indiana, have no idea who equifax is, right . And many of those people have applied for home loans and other things and, as a matter of fact, probably at some point, you have their information, but they just may or may not have been notified who sent the information to them, probably the bank or other agency. And thats just, you know, thats something i think that is also maybe an issue. You know, that people dont understand, dont understand or have not been told who is being used to assess their credit risk and hence Something Like this happens, they have no idea whether or not their information has been compromised. I understand your point. Yeah. I also have a lot of constituents in rural and lowerincome areas that may or may not have access to internet and wifi. The penetrance of that, its interesting depending on where you are, people who have wifi and the internet, its not as high as you might think in rural america. But some of those people still have probably applied for loans and other things where their information could have been acquired by your company. How are you notifying all of those people other than, you know, saying that you have a website. You may have already answered that, and i apologize if you have. But thats important because, again, the penetrance of people having access to internet may be not as high as you think when you come out to rural indiana and other areas. Coming from indiana, i understand rural indiana. There you go. Congressman, we have set up the website that you mentioned. We did a press release across the country. We have also set up, for those who dont have access to the web, the internet, call centers. We staffed up. We went from some 500 Call Center Agents to over 2,700. So i guess i guess thats, again, i understand the call centers and all that. I knew you had done that, but i guess thats, again, making the assumption people have watched the news and know there has been a breach and that they take the theyre proactive in trying to find out whether or not they have been involved or not. Is there any, other than passive way for them to find out, is there anything proactive from equifaxs point of view that might notify them that they have been their data may have been compromised . In many states, theres local state requirements, they have advertisements in newspapers and so on and so forth. We follow these. One indication i did mention earlier, may or may not help those in rural indiana, but the visibility of this has gotten is extremely high. I mentioned 400 some odd Million Consumers had come to our website. So its its gotten the press. And probably after today, it will be more people will know. So thank you for answering those questions. Like i said, my main concern is that my constituents understand whether or not their data has been compromised, and then what are their options Going Forward. You have outlined most of those things today. Im not going to ask you that again. But i do think its important to recognize that, you know, although they are important passive ways to help people become aware of their data may be compromised is one approach, but also an actively informing people proactively might very well be important in certain areas of the country. Thank you. I yield back. The chair now recognizes the gentleman from texas for five minutes. Thank you, mr. Chairman. I apologize. We have a Health Subcommittee upstairs and i appreciate it. Thats not to take away the importance of this hearing. I want to thank you and our Ranking Member for setting it. Were here to discuss one of the worst and most impactful hacks that we have seen. Its a breach that entirely preventable due to a level of negligence thats in some industries could be considered criminal. The Credit Reporting industry is famously unforgiving. If its an industry that helps perpetuate the cycle of property, agencies like equifax force those with lower Credit Scores to pay more for loans and mortgages, less than perfect Credit Scores can result in higher rates for products that dont require credit, like our Auto Insurance premiums. These people have a higher time paying back higher Interest Rates make it more likely they wont be able to pay their debt back on time and will hurt their credit further. Yet equifax and the rest of the Credit Reporting industry expect forgiveness for breach after breach, lobbying congress for even less liability. When restaurants fail regular health inspections, theyre routinely shut down for violations. Theyre shut down even if problems arent even yet occurred as a consequence of their violations. Is it clear why equifax is beyond that point should be allowed to continue operating when they have failed spectacularly at their core business and endangered the public . In the next couple months, Senate Republicans may repeal the Consumer Financial protection bureaus arbitration rule, thus allowing Companies Like equifax to put clauses in their fine print forcing individuals into arbitrary arbitration agreements instead of class action agreements where they stand a chance at being able to recover some of their office, but it should be clear to us by all that is now not the time to roll back consumer safeguards in the financial industry. And i support my colleague and Ranking Member, Congress Woman schakowskys secure and protect americas data act. Look forward to hearing what our witness has to say. Mr. Smith, i. D. Theft Protection Companies have seen a big jump in business in share price since the breach of your company. Including lifelock, who has reported a tenfold increase in enrollment for their credit monitoring in other services. Lifetrack has a contract to purchase Monitoring Services from equifax, meaning that every time someone signs up for lifelock protection through the impact of equifax, they were breached, theyre again volunteering signup for equifax to provide those services and equifax makes money on that breach. Whats the value of that contract that lifelock has with equifax . Congressman, i dont recall what that is, but at the same time, the same consumers have the ability to come to us directly and get free product. Okay. If its available, i hope you would share it with the committee. Mr. Smith, equifax report marketed to its business customers says that leading lifestyle databases available commercially offer hundreds of response segments covering almost every conceivable aspect of how consumers live and what they spend their money on and what interests they have. Can you tell me, tell us as granular level as possible what the sources are for the data for every conceivable aspect of a consumers life . Congressman, i am not quite sure what youre referring to. Were not a data provider in the area of behavioral analytics. Behavioral data, social media data. Im not quite sure what youre referring to. I have a lot of constituents concerned about, for example, they say i dont need to worry about this breach. I havent applied for credit for ten years. But thats not always the case because these hundreds of millions who were released, maybe they bought a, you know, a car 20 years ago, and that data still goes forward, i assume. Mr. Smith, equifax customers are businesses who purchase data and Credit Reports on consumers. The American Public is essentially equifaxs product. How many times per year on average does equifax sell access to a given individuals credit file and to a potential creditor and how much do they make every time they sell it . If i understand the question, congressman, we take the data that is given to us by the credit ecosystem of the u. S. , add analytics to it. Then when a consumer wants credit, again, through a credit card, a home loan, a car, the bank then comes to us for that data and analytics and we charge them for that. The question was how many times does equifax receive payment for that individual credit file . Every time . If my local car dealer contacts equifax, so they pay a fee to equifax for that information . Yes, congressman. If you as an individual want to go to that car dealership and get a loan for a car, they come to us or our two competitors, and when they take your data, access your data, we do get paid for it, correct. The clock wasnt started. You have about 15 seconds. Im sorry . You have about 15 seconds. The clock didnt start up on you. Okay. I thought i just had a perpetual no. Mr. Chairman, i just have one more question. The products at equifax are so far providing victims of the breach to not include anything they wont need if it wasnt for equifaxs lapses on their data. You and i have made more than 69 million in 2016, so thats the concern that the committee has, and i know we have for all of our constituents, and i thank you for your time. Thank you very much. I appreciate the gentlemans questions, and the chair now recognizes the gentleman from oklahoma for five minutes. Thank you, mr. Chairman. Mr. Smith, what is your current job . Im retired. Youre retiring . Are you still getting paid by the company . No, sir. Youre fully retired, so you have no affiliation at all with the company . As a contractor, as no, congressman. I agreed to do because i love this company, its been 12 years with 10,000 people trying to do the right thing. Is i told the board it was right for me to step down. Had new leadership take this company in a new direction. So when i retired, i agreed to work for as long as the board required for free. To help make it right for the consumers. So the affiliation is to do free work with the board of directors and the interim ceo. So youre not getting paid in any manner, not to any type of shares, stocks, anything . Nothing. The day i announced my retirement do you still own stock in the company . Im sorry. Do you still have stock in the company . Oh, yes. Had you sold any of it . I have been there for 12 years. Yes, sir. Recent, since this has become aware to the public. During this breach . Yes. Northwest. Are you aware of the individuals who have . Yes, there are three individuals who are reported directly to me while i was their ceo. That sold stock . Yes. And all three of them are men i have known, i mentioned earlier, for a number of years. Two for almost 12 years and one for three or four years and theyre men of high integrity. Did they sell it before this went public . Yes. As i said before, the knowledge, we went public with this on september 7th. When did they sell their stock . August 1st and 2nd. So after the breach . No. The timeline of the end of july, 29th and 30th, the notification on the 31st of suspicious activity, at that time, one and two days prior to their selling, there was no indication what would cause them to sell it . There is a what we call section 16 officer. Mmhmm. Theres a limited window in which they can sell. Okay. Tends to be right after the Earnings Call for no more than 30 days. This is a natural process. The window opened after the Second Quarter window. In your Opening Statement, you made mention theres an error in the portal. And it was three weeks before you were notified of a breach. If i can clarify. Yes. There was a software called an open Source Software that was deployed in this environment, this consumer portal. Right. We never found a vulnerability to patch that vulnerability. That was the issue. Who was in charge of overseeing that . Who was supposed to watch the portals for you . Ultimately me. I get that. But who did you have hired that was supposed to watch that . It was the vulnerability side, there was you have department thats dedicated to this . A chief Information Officer was ultimately responsibility. Is that person still over that department . No, sir. Hes gone. Hes gone. You said you put in, once you were made aware of the breach, you put in four plans of action, right . The first one was, do you remember . Notification. Notification. The second one was a call center. The third one was increase cyberattacks, preparing for that. Fourth was coordinating with Law Enforcement. Im also or was ceo, not on the company side that you have, but from the companies that my wife and i have had. And we have protocols put in place of what could happen. We know cyberattacks happen. You hear it every day on the news. These four things that you named were common sense. Things that should have been put in place to begin with. It should have been the fire alarm. Youre in that world. This should be on the side of the wall where you pull the handle and immediately goes into place. How was it that it was just now thought of that you need to have four co commonsense principles put in place on how to react to something in a world where we kn knew you were vulnerable to be hacked . We have protocol, the team followed protocol. This is well known what to do from hiring a cyberforensic expert, we knew what to do. We had done it before, engaging a world leading cyberarm of a law firm. We knew what to do. These are all protocols where they knew what to do. The one thing, congressman, thats not a switch on the wall. The ability to stand up, the environment we had to stand up it took a long time to stand up. Thats the issue that we have here. Is you are on the leading front of this. And the four things you identify to me, i dont mean to simplify it by saying a switch on a wall. But these protocols should have already been put in place and you should have been able to react much, much sooner than what took place. With that, im sorry, i dont mean to cut you off, but the chairman has indulged me longer than he should have. The gentlemans time has expired. The chair now recognizes the gentle lady from california, ms. Waters, for five minutes. Thank you, mr. Chairman. Mr. Smith, before i get to my question, i just want to say that on behalf of the 15 million californians whose information was exposed, we expect better. Your Business Model was based on collecting and maintaining the most Sensitive Information on folks, and you let us all down. And that happened on your watch. And from my briefings, it appears this could have been and frankly should have been prevented. As equifaxs Business Model depends on gathering Consumer Information, repackaging it, and selling it. Equifax has set up a website in which consumers can enter information to determine if they are at risk and sign up for credit monitoring and credit lock. To participate, a person has to give equifax the same type of personal information, including Social Security number, which equifax put at risk in this breach. I want to know what equifax is planning to do with this information besides offering credit monitoring and credit locks. Can you insure me that equifax will not plug this information back into its core Business Operation and sell it to its lenders . Equifax should not benefit from this situation and i want to know that equifax is going to wall off this information and guarantee that the company will not profit from this situation. Congresswoman, thank you for your comments. And as i mentioned in my written testimony, my oral testimony, i said throughout the morning and ill say again today. As a ceo, it was under my watch. Im responsible. Im accountable. And i apologize. To all of your consumers in california. The intent of this offering were giving to your constituents in california and across the country is an environment where were not going to sell other products. Its being serviced with protection of the five offerings you had mentioned, not to sell and take your data and monetize that. Its to take and protect you with these five services. Okay. Equifaxs breach notification website uses a stock installation of word press. This causes me a lot of concern because it seems to have insufficient security for a site asking people to provide part of their Social Security number. Can you assure me that this website is secure and will not further endanger the personal information of my constituents . Congresswoman, we took we believe is the right amount of time looking hastily from late august, going live on the 7th, one of the four work streams the congressman mentioned is prep e insuring we were prepared for what were increased cyberattacks as told to us by our forensic examiners. One of the first things we did is insure the website were bringing consumers to to get these Free Services was as secure as possible. That was one of our top priorities. Okay, and finally, my last question is, how many u. S. Consumers have enrolled in the Credit Monitoring Service trusted i. D. . Ill just finish here, because i know multiple people who have enrolled, including my immediate family. And they were told that they would receive an email to complete the process. After days of waiting, they have not received an email. And wanted to know what the delay and cost to add this protection and when will they be able to complete the process to help protect their information . I understand the question. I mentioned earlier over 400 Million Consumers have come to the website. Obviously, we dont have 400 Million Consumers in the country, so a number of them came back multiple times, but its a lot of volume. Number two, i was told in the last few days, that the backlog waiting for those emails has now been fulfilled, drained as you come into the system, a more immediate response. So the teams have made great progress in the last couple weeks. Thank you. I yield back the balance of my time. Thank you very much. The gentle lady yields back. The chair now recognizes the gentleman from pennsylvania for five minutes. Thank you, mr. Chairman. I have heard from hundreds of constituents in my congressional district. There are approximately 5. 5 million in pennsylvania. I have reviewed each and every one of the constituents stories i have received, and amongst my growing concerns, your baseline security practices leading up to the breach, the company ps awareness of the breach developments and relevant timing, how consumers can get assistance in securing their accounts. How reliable the Recovery Efforts are in the wake of the breach, and the path forward, longterm, for consumers personal information and making sure theyre safe despite the breach. Its this last one that is so particularly angering because it is going to potentially be so destructive to hundreds of millions of americans what might happen to them in the years to come. And as the head of the company, and throughout the company, the culture of that company has to know how predictable the damage can potentially be. And so i ask you, is it not predictable how bad it might get for the individuals who have been compromised . In terms of how much damage could be wrought upon them individually in the years to come . Congressman, let me start by saying that like you, i have talked to constituents, consumers, across this country. Who have been impacted. I personally read letters from consumers complaining, voicing their anger and frustration. So i know what youre seeing back home in pennsylvania. See, i think the anger is going to be multiplied thousands of times when something actually happens. And so when you talk about how predictable some of this is, the rollout of the call centers and the second rollout and the third rollout, it has to be predictable how massive this is and what would need to be put in place from a protocol perspective in order to address whats coming. And the slow rollout and how poor it was done, to me, is just inexcusable. You have to have departments dedicated to dealing with this potential, and it doesnt appear to me as though that was planned. Or if it was planned, it was planned extremely poorly. I understand your point. But it requires a little more color. We went from 500 Call Center Agents to a need of almost 3,000. Properly handled Call Center Agents to handle consumer calls. We did the best we could in a short period of time to ramp those up. I mentioned in my opening comments, two of our larger call centers in the hurricane. Taken out by Hurricane Irma. We were not prepared for that kind of call volume. How couldnt you be . How couldnt you be . Its not our traditional Business Model. Our traditional Business Model is dealing with companies, not 400 Million Consumers. But your Business Model has a couple hundred million customers, so on a breach of this scale, obviously, youre going to have at least that number and probably twice that amount of people calling and inquires as to whether or not theyre subject to the breach, and that wasnt done. Congressman, the difference is the primary Business Model we have is dealing with companies, not with hundreds of millions of consumers. We did the best we could to react as quickly as we can. I mention the service is getting better. Each and every day. We have listened to consumers feedback, tried to make changes to the website, to the call center. Youre familiar with the safeguards rule . Its essentially what you operate under. Yes. How often does a Forensic Consultant issue a letter or a certification or a law firm issue a certification that they feel your protocol is in compliance with the safeguards rule . We are in compliance, im not sure how often its communicated. How would you know youre in compliance then . Because if you say you follow protocol, and protocol led to this, its difficult that calls into question whether the safeguards rule is sufficient enough. If youre saying youre in compliance with it and you file a protocol and this still happened, that unearths a whole other set of question. The speed of reaction and the scale of the reaction was unprecedented. Im not making excuses. Yes. But theres a Corporate Governance issue here as i see it. That is your board of directors gets together, youre ceo yorxia have a chief Information Officer, a Security Officer, and at least once a year and probably quarterly, you have, i presume, outside Forensic Consultants doing this stuff every day for you on retainer. The speed at which you have to do this just to run your company operationally, you dont ever stop. Its obviously ongoing. And persistent. And it just seems to me that through insurance policies, through reporting to your board, through your board wanting to make sure theyre doing their job, that youre looking for certifications from your Forensic Consultants saying youre doing good, youre doing good. Here are the new threats. Heres how were updating. I just dont see, thats the kind of information i think would be extremely helpful that we have not received any information from today. But i would ask you, since im well over my time, that i would like to know how often your board asks you to certify whether or not youre in compliance, and what is that protocol, and when was the last time you updated the protocol . You said you complied with protocol. When was the last time that was updated . I understand your question. Well get you that information. Do you yield back after youre already well over . I yield back. The time has expired. Hows that . The chair now recognizes the gentleman from georgia im sorry. Im sorry. Gentleman from new york. Five minutes. Thank you, mr. Chair. Americans should know their sensitive personal information is safe. Their security is exposed when private companies, including equifax, can collect their private information without their direct knowledge or consent, and its why im cosponsoring representative schakowskys measure, hr3896, the secure and protect americans data act. Mr. Smith, we are here today because months after the breach actually took place, your company, equifax, revealed thats its forprofit Business Practices have exposed the highly sensitive personal information of some 145. 5 million americans and counting. Your data breach exposed a critical vulnerability in the American Economy and the Information Security of the American People. The victims of this breach span every age group, every race, class, and other demographic. They now face a lifetime at risk of fraud, Identity Theft, and other crimes as a result of the private data that you exposed. I have many, many questions. Allow me to be the conduit through which my constituents ask you, mr. Smith, their questions. Ill go first to a constituents pointed out to me, it would be wrong to call the victims of this breach equifax customers. Most of them never asked to be tracked and judged by a private company with little public oversight or accountability. This is unacceptable. And he asks why hes been impacted in this manner. Any comments to the question . Again, congressman, i have read many similar letters and talked to people back home in atlanta who voiced that same concern. I can tell you this. Were a company thats been around for 118 years. 10,000 employees trying to do whats right each and every day. I apologize to the individual who wrote you that letter. I apologize to america for what happened, and were going to try to make it right. My constituent jason from albany asked, mr. Smith, to the best of your knowledge employ the best and most effective defense available to you to prevent this breach . A kricrisis never occurs if everything has gone right. In this case, we had a human error and a technology error. It wasnt because we were unwilling or unable to make the Financial Investments in people, process, or technology, though. My constituent tanya asks, how do i get equifax to fix this without signing over my rights . And what related costs will i, tanya, be expected to pay over my lifetime . The five products we launched, services we offered in september are all free. Theyre all spelled out in the press release. They give that individual significant protection. The most comprehensive change is coming in january of next year when is the ability for consumers to lock and unlock their data when they want and only when they want. And any relates costed she should expect to pay . Services are all free. Number of my constituents would like to know given that the sole purchase of credit agencies secure handling of consumers confidential information, which they spectacularly failed to do, why is this company allowed to continue to exist . We have a rich history of helping those who want to get access to credit, to get access to credit. The company has done many great things to help those in the unbanked world who would never otherwise have access to credit, because what we do, bring them into the credit world. Constituent lee from albany asks why are you using this gross misconduct to turn your victims into customers for a paid monsterring service that you will profit from. This is not our intent. Our intent is to offer the five services for free, followed by a sixth lifetime lock for free. My constituent karen says why havent you notified each person whose data was compromised, folks who never asked to you to score their information. So where are the representatives and why should they be responsible for your malpractice . Following the recommendation of those who advised us, we did notify through the press release, notifying the entire population not just those who were the victim of the criminal hack, but all americans to get access to these products and services for free. And my constituent james from new york asked why did it take so long to announce the data breach and why shouldnt you be held responsible for every day of failing to report . I think hopefully my written testimony, my oral testimony, and the dialogue we have had today has talked about the timeline in enough granularity to help that person understand what occurred from march through september 7th. And a constituent stephanie asked, do they know if the people were targeted or randomly picked . Why some but not others . At this point, all indications are it was at random. It was targeting of individuals specifically. I have exhausted my time, but let me assure you, mr. Smith, i have many, many, many constituents questions that continue to pour forth and were going to provide those after the hearing here. And would expect that they would all be answered, and again, thank you for your response. I yield back. Thank you very much. The gentleman yields back. The chair now recognizes the gentleman from pennsylvania for five minutes. Thank you. Thank you, mr. Chairman, for allowing me to sit on this hearing. My fellow members have already asked a lot of questions, very important highlevel questions, but i want to take a memant to dig more deeply into a few specific issues. We now know that equifax information Security Department ran scans that should have detected systems that were exploitable, but that the scans didnt detect any. I foresee at least one system was vulnerable. If the scan was improperly configured to catch this vulnerability, in other words, you missed a major breach, is it possible that it has also been improperly configured to detect similar vulnerabilities . I no knowledge of that. I have no knowledge of that being the case. You have to feed the information in these scans and it has to be complete and accurate information. And this information apparently wasnt fed in was fed in an incomplete way, is that true . Can you repeat the question please . In order to scan something, a human has to feed it information, right . I am not a scanning expert, congressman. My understanding is that you have to configure the scanner in certain ways to look for certain vulnerabilities. A lot of what is going on is youre saying no humans are involved, but configuring is done from a human being, right . And inaccurate information got in there, too. If it was improperly configured to catch the vulnerability, is it possible it is improperly configured to detect similar vulnerabilities . I have no information that is the case. Scammers were using it for sfishing. Someone switched two words and made it into a phishing website that looked identical. Luckily, this person was just trying to make a point, but the point is well taken. You said today you set up this external website because equifax wouldnt be able to handle the sheer amount of traffic. It doesnt make sense. A company of your size and knowledge doesnt understand how to handle traffic for over 100 Million People. Dont you use an elastic Cloud Computing service that would have accounted for that. A point of clarification, the phishing site you refer to was mentioned a few times today, was an error by a individual in the call center. Let me ask the question, we have that established, but i want to ask this question, though. You wouldnt be able to handle the sheer amount of traffic. Dont use use Something Like a sheer elastic cloud. The environment microcyte is in a cloud environment. Its very, very scalable. The traditional environment we operate in could not handle 400 million consumer visits in three weeks. I want to come back to some of this stuff, too. I want to come back to the issue of patching the vulnerability. I know this has come up a few times but i want to make sure to highlight this point. Our understanding is that the vulnerability required more effort than simply installing a patch. We also understand when equifax patched the vulnerability, it took less than three days to do so. The patch only took a few days to apply, why did equifax fail to install it immediately after it was announced as critical . Patching takes a variety of time. Im not sure where you got the note that its three days. Patching can take days to up to a week or more. Did you notify everybody it was going to take some time. Im sorry . Did you notify your customers it was going to take some sometime . Did you notify people there was a risk that you were trying to apply the patch. No standard protocol . I didnt ask about standard protocol. I asked if you notified people. No knowledge that we notified consumers of a patching process. You didnt notify people a patch was going to take place and the risk existed. Did other executives of your company, were you aware of it . As i said before, i was not. You were not aware that there was a problem with vulnerability . You just told me it takes a few days to a few weeks. You werent aware it existed . Thats correct. Let me wrap with one final thought. You state the breach occurred because of human error and technology failures. Looking at the three issues i highlighted, these are not failures of technology. Human misconfigured the scan, a human selected the website name, a human failed to apply the patch. While i understand cybersecurity is a mentally complicated field, we have dealt with this many times on the committee, and i also think its important to be up front about the cause of breaches like this. If we continue to blame human technology, i think well have a very difficult time improving our capabilities and preventing future cyber threats. Mr. Chairman, i recognize im out of time. Well see you again in my subcommittee. Thank you very much. The gentlemans time has expired. And the chair now recognizes the gentleman from maryland for five minutes. Thank you, mr. Chairman. Mr. Smith, thank you for being here. You have been the president of the company for, ceo for 12 years, is that right . That is correct. Theres three things i think that the public is angry about, certainly as my colleague was indicating, were getting a lot of messages and contacts, inquiries from our constituents across the country. First of all, they want to understand, and you have tried to explain it today, but im not sure its going to be satisfactory why there wasnt sufficient protections in place on the front end so that this kind of breach wouldnt happen in the first place, given the sensitivity of the information that youre keeping in the company. The second thing is how quickly once a breach was discovered you came clean to the public and provided information on what was happening. There seems to have been a delay there that concerns people. The third is whether the services that youre now providing to people you have enumerated five or six Free Services that youre providing to people. Whether thats going to be a sufficient assurance to folks Going Forward that their identity can be protected, that their information is safe and so forth. So youre trying to fish thix t now, but theres going to continue to be, i think, serious questions about all three of those things that i just mentioned. I wanted to ask you about the kind of remedies you have out there because theres some confusion. I got a question from a constituent who had purchased a Monitoring Service that would cover his family, including a child under the age of 18. So first of all, can you tell me, it is possible for someone under the age of 18 to have their identity stolen, is that correct . As far as you understand . Is it possible . Yes . As it relates to this breach . Just generally. Identity, if certain information about a minor is divulged to some unscrupulous actor, that can be used to steal the identity of the person. If someone has a Social Security number at any age, can that be compromised, yes. It cannot be compromised in this case because this database they got into, from my understanding, was only for people who have credit active or inactive. They have been in the credit environment. But my understanding is when you provide a family service, youre collecting information and Holding Information that includes the Social Security number of people who may be under the age of 18. I have no knowledge that under 18, not credit active, was compromised here. I can look into that. I have no knowledge. If that is the case, is the free service that you are providing going to cover any exposure or information thats related to a minor as opposed to somebody whos over the age of 18, if you had information on that minor . I can look into that, congressman. The intent of the coverage was to cover anyone in america who is in the credit system. So if youre under 18 and not in the credit system, ill check your one point which is on this concept called family plan that youre alluding do where you lockdown consumers. I dont believe their security numbers were in the system but we can verify that. If i can interrupt. We had a clock issue. You have about 30 seconds left. Thank you. I think its important because it may be that with respect to Credit Reporting, implications of this breach are only attached to people who are 18 or older. But if youre Holding Information about minors like a Social Security number, thats part of the portfolio of information youre getting from a family, for example, particularly when the family has paid for this service. Youre holding their Social Security number. So any breach that makes that Information Available outside of the arena in which its supposed to be kept close, creates vulnerability for that person. Its not like we get a new Social Security number when we turn 18. So thats going to follow them all the way through and create some real risk for them. So i think thats a piece of this that we need to understand much better. And i want to thank my constituents for sort of bringing that to our attention. I understand your point. To the best of my knowledge, that data is not included in the breach. Ill look into it. Thank you. I yield back. Thank you very much. The chair now recognizes the gentleman from georgia. For five minutes. Thank you. I want to thank you for allowing me to sit in on this today. Mr. Smith, thank you for being here. I know its been a tough day. Its been a tough past couple weeks. I appreciate you being here. Thats important. Im not going to apologize for my colleagues and their questions and their aggressiveness, if you will, because as you know, people are upset. Theyre mad. You get it and i get it. We all understand it, but nor am i going to pile on. I want to kind of go a different route, if you will. One of the things that i have learned in two and a half years i have been up here is to be very careful about my southern phrases, but one of my southern phrases has always been that, you know, fool me once, shame on you. Fool me twice, shame on me. I want to go what we can learn from this. This is not the first time a data breach has happened. Perhaps its the biggest its ever happened, but its happened to other companies before. To the extent you werent prepared for this or it happened to you, and i hope that was not due to complacency, i hope it was not due to you not doing everything you could to have prevented it. But my question is this. Can you share with us any information about the attackers . Now, what do you know and what do you not know about them at this point . Congressman, thank you for that. As i mentioned in my opening comments and my written testimony earlier this week, we engaged the fbi, and they currently have the investigation in their hands. So this juncture, were not disclosing what we know about the hackers. How is your cooperation with the fbi been . Is your experience with them thus far been good . This is important. Its important for everyone. Yeah, everyone is upset, and rightfully so. They should be upset. When your personal data is out there, obviously, its very upsetting. But im trying to go to a different direction. Im trying to figure out how we can prevent this from happening. The cooperation with the fbi, as best i know has been good. Its on going. We have lines of communication into the fbi, not just after the breach but routinely throughout the year. So i would say its been a very good cooperation, congressman. Let me ask you this. Through this scenario,this, thr this scenario, through this experience, rather, if you had to do anything different, what would you have done . Congressman, i was asked that question earlier, and my answer will be the same now as it was earlier. There will be time for reflection personally and as an organization. That coupled with the investigation that we continue to undertake to look at processes inhouse. But at this juncture, since i was notified in mid august through this morning its all been about the forensics. Its been about trying to protect and do whats right for the consumer and there has been no time to reflect on what i would do differently into when that time comes, we need to know. We dont need to let this happen again. And other Companies Need to learn from it. This is obviously as i said earlier you are not the First Company to suffer from there, you are not the first Georgia Company to suffer from this. We understand that. Doesnt make it any lessee griedgeous to what has happened. But where im trying to go is what can we do better to prevent this from happening again. These guys are good. We know that. Listen, Cyber Security is hard. Its way above my pay grade, i can tell you that. Congressman, thank you for that. As i mentioned in my comments, i take full responsibility as ceo. I understand in a, and i appreciate that. If there is one thing i would love to see this country think about, its the concept of a Social Security number in this environment being private and secure, i think its time as a country to think beyond that. What is a better way to identify consumers in our country in a very secure way . I think that way is Something Different than an ssn, a date of birth, and a name. Well, you are exactly right. I rr my time in the Georgia State legislature when we changed you know, you used to have your Social Security number on your drivers license. It used to be your drivers license number. We i think changed. That was not that long ago. Thats what tells me, this is something that is changing dramatically and quickly. And we need to be prepared for it. So i know that you are putting out fires right now. But at some point, we need to learn from this. We need to know, look, we shouldnt have done this, we should have done that. What could we have done differently . What will benefit another company to allow that this doesnt happen . And i hope, thus far you appear to have been honest about all of this. I hope that if part of what the problem was was complacency that you would admit that and say dont, dont ever let your guard down. Thank you, congressman. I would love to be part of that dialogue about what lies ahead to protect individuals identities. Again, want to thank you for being here. It satisfies a lot about you and about your company. Thank you. Thank you mr. Chairman. The gentleman yields lack. The chair now recognizes the gentle lady from california for five minutes. Thank you mr. Chairman. First i would like to recognize recognize saxby chand list who served in the house and the senate. Its good to see you. Very nice to see you. Mr. Smith, it seems to me that you have accomplished something that no one else has been able to accomplish, and that is that you have brought republicans and democrats together in outrage and distress and frustration over whats happened. Because this is huge. This is almost half of the country and their information. You know, the American People are i think they have privacy in their dna. Way dont like big brother. We dont like people having information on us. We know in an information and in a digital age that thats impossible, but boy, when thats breached, when the privacy goes out the window, it really puts a department in peoples lives. I equate it with because, they dont feel they can do anything about it. They feel helpless. I come from earthquake country, and when that rattle first starts, you really do feel helpless. You feel absolutely helpless. Now, its been the question is kind of been posed retorically by some members because i have been sitting in for a while at this hearing, what can be done . I have the privilege of representing most of silicon valley. I have asked this question about the protection in terms of privacy, breaches in our country, to just about every ceo ive met. And they have responded like a chorus and said that there are two main reasons for breaches in our country. Number one, a lack of hygiene in systems, and very poor security management. Thats why we have legislation. Senator hatch is the lead sponsor in the senate. I have the bill in the house. So its distressing to me knowing this information that Homeland Security notified equifax this is almost seven months ago. This has to do with a patch. So i know there are a lot of questions that have probed this, but you as ceo at the time, when Homeland Security informed your company that there was a breach, what did your what did you say to your cio officer . Did you understand what the breach was . Did you understand what the patch meant . Did you understand the timeliness, the need for timeliness to have this fixed . And did anything change in that department . Was there a new policy put in place by you . Congress woman, to clarify, when the search came out in march, there was no notification of a breach. There was notification what did it mean . What it meant was if i got a notice from Homeland Security thats like the fbi knocking on the door. Thats the federal government. That in and of itself is a bit menacing, isnt it . What it meant was an open Source Software called apache struts had a vulnerability. And the notification was the vulnerability should be patched. All right. Did you ask if it was patched . We get notifications no. You got the notification from Homeland Security. All right . What did you do about it the day you found out . The company was notified on i believe the 9th of march. When did you know . The team, Security Team, followed protocol and instptly, within a day sent notification out the many people in the organization that a patch needed to be applied to apache struts. Did you ask your team when it was applied . The Security Team did, and i spoke with the i. T. Team as well. When did they take care of it . Throughout the testimony we talked about what occurred was. Tell me when it happened. When was it actually the following day, communication was sent out to those who needed to be notified. You already said that. I want to know when they did it. When they took care of it. They took care of it in july because we never found it. It wasnt until your call we had the human error, we did the scan, the Technology Never found it. In july, we saw suspicious activity, took the portal down, found the vulnerability, applied the patch. Well, i thank the chairman. We have in the rules of the full committee which are approved at the beginning of every congress that members of the full committee can participate in subcommittees where they are not members. And i appreciate the legislative courtesy. And i think that there is a lot more to be done on this issue, mr. Chairman, if i might make the recommendation, i think we should have the cio, the chief Information Officer, come in because i dont think that this is resolved. So thank you. Thank you very much. Nice to see you saxby. The gentle ladys time has expired. We are going to ask one quick follow up question. I yield to the Ranking Member first. First of all, mr. Chairman, i would like to insert for the record letter from Consumers Group to letter from Credit Union National association, and article from wgn tv. Without objection, so ordered. Oh, sorry. So, in closing, mr. Smith, i want to quote again from you from your testimony. You mentioned the five fixes, socalled, and you put this puts the control of consumers Credit Information where it belongs, with the consumer. So i want to ask you a question. What if i want to opt out of equifax . I dont want you to have my information anymore. I want to be in control of my information. I never opted in. I never said it was okay to have all my information. And now i want out. I want to lock out equifax. Can i do that . Congresswoman, that requires a much broader discussion of the rule of the Credit Reporting agencies. The data as you know today doesnt come from the consumer. It comes were the furnishers. And if furnishers provide that data to the entire industry. No. I understand that. And thats exactly where we need to go, to a much larger discussion. Because most americans really dont know how much information, what it is, that you have it, and they never said okay. So im hoping that will lead to wider discussion. Thank you. Thank you very much. The gentle lady yields back. And if i may just go back to what we had a little discussion earlier he the beginning. Going back to your testimony from auction 15th when you reported likely that Consumer Information likely had been stolen. Again, why was there again a tenday delay between finding out about that personal information that could have likely been stolen to developing that remediation plan . That tenday window. Why did it take ten days to start that remediation . Well, congressman, there was continuous work going on around the clock from that time through yesterday trying to develop the product, develop the communication plan, stand up website, inform those that needed to be informed. It wasnt like on a certain date something occurred. It was continueual motion by many people prosecutor many, many weeks. Let me ask a follow up on that then. Because again with that tenday period of time, when was the appropriate time really to Start Talking to the consumers at that point in time or again waiting until you did in september . Again, there was that lag time where information could have been stolen on individuals. Yeah, the whole goal was to make sure that the data we had was as accurate as clear for the u. S. Consumer as possible. Number two it was to make sure for the forensic Cyber Security specialists that our environment was as secure as possible. Remember they said expect increased attacks. Number three was the stand up the call centers and the website for hundreds of millions of consumers. And that just took time as i alluded to earlier. Thank you very much. And seeing that there are no other members present to ask questions we want to thank you very much for testifying before the subcommittee today. Pursuant to Committee Rules i remind members they have ten additional days to submit questions for the record. I ask that the witness submit his response within ten Business Days of any request submitted. Without objection, the subcommittee is adjourned. There will be more testimony from former equifax ceo Richard Smith as he appears tomorrow before the Senate Banking committee. That will be at 10 00. Then on thursday he appears at 9 30 eastern testifying before the House Financial Services committee. Both of those hearings by the way on cspan2, cspan. Org or linen the free cspan radio app. Go live now to capitol hill as defense secretary james mattis and general