NEW YORK (AP) — Equifax announced late Friday that its chief information officer and chief security officer would leave the company immediately, following the enormous breach of 143 million Americans' personal information. 
 
 The credit data company — under intense pressure since it disclosed last week that hackers accessed the Social Security numbers, birthdates and other information — also released a detailed, if still muddled, timeline of how it discovered and handled the breach. 
 
 Equifax said that Susan Mauldin, who had been the top security officer, and David Webb, the chief technology officer, are retiring. Mauldin, a college music major, had come under media scrutiny for her qualifications in security. Equifax did not say in its statement what retirement packages the executives would receive. 
 
 Mauldin is being replaced by Russ Ayers, an information technology executive inside Equifax. Webb is being replaced by Mark Rohrwasser, who most recently was in charge of Equifax's international technology operations. 
 
 Equifax also provided its most detailed timeline of the breach yet, although it raised as many questions as it answered. 
 
 The tale began on July 29, when the company's security team detected suspicious network traffic associated with the software that ran its U.S. online-dispute portal. After blocking that traffic, the company saw additional "suspicious activity" and took the portal's software offline. 
 
 At this point, Equifax's retelling grows cloudy. The company said an internal review then "discovered" a flaw in an open-source software package called Apache Struts used in the dispute portal, which it then fixed with a software patch. It subsequently brought the portal back online. 
 
 But that vulnerability had been known publicly since early March 2017, and a fix was available shortly thereafter — facts that Equifax acknowledged in its Friday statement. The company did not say why the software used in the online-dispute portal hadn't been patched earlier, although it claimed that its security organization was "aware" of the software flaw in March, and that it "took efforts" to locate and fix "any vulnerable systems in the company's IT infrastructure." 
 
 It apparently missed at least one vulnerable system. The closest Equifax gets to explaining that? "While Equifax fully understands the intense focus on patching efforts, the company's review of the facts is still ongoing," according to its statement. 
 
 After patching the dispute-portal's software, Equifax hired Mandiant, a computer-security firm, to do a forensic review. That effort determined that hackers had access to Equifax systems from May 13 through July 30. 
 
 Equifax has been castigated for how it has handled the breach, which it did not disclose publicly for weeks after discovering it. 
 
 Consumers calling the number Equifax set up initially complained of jammed phone lines and uninformed representatives, and initial responses from the website gave inconsistent responses. The company says it has addressed many of those problems. Equifax also said Friday it would continue to allow people to place credit freezes on their reports without a fee through Nov. 21. Originally the company offered fee-free credit freezes for 30 days after the incident. 
 
 Equifax is also facing several inquiries and class-action lawsuits, including Congressional investigations, queries by the Federal Trade Commission and the Consumer Financial Protection Bureau, as well as several state attorneys general. The company's CEO Richard Smith is scheduled to testify in front of Congress in early October. 
 
 Three Equifax executives — not the ones who are departing — sold shares worth a combined $1.8 million just a few days after the company discovered the breach, according to documents filed with securities regulators. 
 
 Equifax shares have lost a third of their value since it announced the breach. 
 
 ___ 
 
 AP Technology Editor David Hamilton in San Francisco contributed to this report. ||||| When Congress hauls in Equifax CEO Richard Smith to grill him, it can start by asking why he put someone with degrees in music in charge of the company’s data security. 
 
 And then they might also ask him if anyone at the company has been involved in efforts to cover up Susan Mauldin’s lack of educational qualifications since the data breach became public. 
 
 It would be fascinating to hear Smith try to explain both of those extraordinary items. 
 
 If those events don’t put the final nails in his professional coffin, accountability in the U.S. is officially dead. And late Friday Equifax said both Mauldin and the company’s chief information officer have retired effective immediately. 
 
 Susan Mauldin’s LinkedIn page was made private and her last name replaced with “M.” 
 
 Equifax “Chief Security Officer” Susan Mauldin has a bachelor’s degree and a master of fine arts degree in music composition from the University of Georgia. Her LinkedIn professional profile lists no education related to technology or security. 
 
 This is the person who was in charge of keeping your personal and financial data safe — and whose apparent failings have put 143 million of us at risk from identity theft and fraud. It was revealed this week that the massive data breach came due to a software vulnerability that was known about, and should have been patched, months earlier. 
 
 I emailed Equifax’s EFX, +0.49% multiple media relations people but have not heard back. 
 
 I was tipped off to this by a contact on Twitter. There has been very little coverage so far of Susan Mauldin’s background and training. Given the ongoing disaster of the hack and Equifax’s handling of the affair, the media spotlight has so far been elsewhere. 
 
 Reporting by a few tech-savvy blogs has found that as soon as the Equifax data breach became public, someone began to scrub the internet of information about Mauldin. 
 
 Video: Why victims of the Equifax breech should freeze their credit 
 
 Her LinkedIn page was made private and her last name replaced with “M.” Two videos of interviews with Mauldin have been removed from YouTube. A podcast of an interview has also been taken down. 
 
 Unhappily for the scrubbers, the internet archives some material and a transcript of one interview has survived. 
 
 To play devil’s advocate, Mauldin does at least have 14 years’ private-sector experience since getting her degrees. Music, to stretch the point as far as possible, is an academic subject that can be highly mathematical. 
 
 The question is how far any of this can take you in this field if you don’t have a formal education in technology. Mauldin’s counterparts at Equifax’s two biggest competitors, TransUnion TRU, +2.71% and Experian EXPN, +2.28% studied computers and science, respectively. 
 
 In an interview I found, Mauldin said that in recruiting, “[w]e’re looking for good analysts, whether it’s a data scientist, security analyst, network analyst, IT analyst, or even someone with an auditing degree. ... Security can be learned.” 
 
 But she also said she focuses college recruitment, understandably, on “universities that have programs in security, cyber security, or IT programs with security specialties.” She did not mention music composition. 
 
 Everything about this fiasco just gets more and more surreal. 
 
 Read next: Were you affected by Equifax’s breach? You risk financial chaos by doing nothing ||||| In the worst possible way, the monumental data breach at Equifax -- involving the names, addresses and social security numbers of some 143 million people -- draws attention to a long-neglected gap in the U.S. system of financial oversight. The Consumer Financial Protection Bureau ought to take the lead in putting this right. 
 
 Equifax CEO Smith Resigns Following Data Hack 
 
 The three big U.S. credit reporting companies -- Equifax, Experian and TransUnion -- have an unusual combination of power and lack of accountability. They dominate the business of collecting information on consumers, influencing everything from who gets jobs to how much interest people pay on mortgages. But they're not answerable to those consumers; they primarily serve the banks and other customers that buy their products. As a result, they lack strong incentives to invest in keeping sensitive data secure, or to fix mistakes that can ruin people's lives. 
 
 Equifax's Massive Breach Tests Trump and Capitol Hill 
 
 Granted, keeping data secure is difficult, and Equifax is hardly the first company to let people down in this fashion. Also, it's too soon to know how the breach happened, whether the company was negligent, and what kinds of additional defenses could have made a difference. But it isn't too soon to say that the credit reporting companies need more rigorous oversight, not least to provide full and authoritative answers to those questions. 
 
 Over the years, U.S. authorities have acknowledged the problem. The Fair Credit Reporting Act, the Federal Trade Commission, the CFPB and state attorneys general have all pushed the companies to reduce errors and be more responsive to consumer complaints. As often happens, though, multiple regulators with overlapping responsibilities are collectively ineffective -- and issues still abound. The companies are subject to the same data-security rules as banks, but don't face the same level of oversight. 
 
 The threat of lawsuits doesn't provide much discipline, either. Although the FCRA allows for civil liability, it's hard to link the companies' failures to specific harm -- and the Supreme Court recently raised the bar. Who, for example, will be able to prove that the Equifax hack led directly to the misuse of their data? 
 
 Equifax's lamentable management of its hacking crisis illustrates how badly skewed its incentives still are. Criminals made off with enough information to steal the identities of millions of Americans, yet the company has shown astonishingly little concern for the people affected. The website it set up could not reliably indicate whose data had been stolen. It initially demanded that consumers waive their right to sue in return for "free" credit monitoring (which would convert into a paid service after one year). 
 
 Ideally, Congress would respond with new legislation to give the CFPB clearer authority to police the companies. It could even opt for a more utility-like approach, allowing the CFPB to cap profits until they meet benchmarks for accuracy and privacy. But the companies spend heavily on lobbying, and it would be unwise to rely on Congress: On the day Equifax announced the breach, the House Financial Services Committee was considering legislation to reduce their legal liability. 
 
 Rather than waiting for new legislation, the regulators should do more with the powers they already have. Under FCRA, the CFPB can penalize companies for failing to make "reasonable" efforts to keep sensitive information out of the wrong hands. The bureau should thoroughly investigate whether such efforts were made in this case, and demand strong remedies for any transgressions. If it takes the lead in this, the CFPB can set a new standard for the firms' protection of financial data. 
 
 Equifax has made the strongest possible case for more effective regulation of the credit-reporting companies. It's up to the CFPB to respond. 
 
 --Editors: Mark Whitehouse, Clive Crook. 
 
 To contact the senior editor responsible for Bloomberg View’s editorials: David Shipley at davidshipley@bloomberg.net .
– Two senior Equifax execs have stepped down as the investigation of what may be the biggest data breach in US history continues. The credit-reporting firm says security chief Susan Mauldin and chief technology officer David Webb are retiring effective immediately, the New York Times reports. After the leak that exposed the data of 143 million Americans became public, it emerged that Mauldin has a degree in music composition but apparently no education in technology or security. Interviews with Mauldin have been removed from YouTube, though MarketWatch unearthed a transcript of one in which she says they are interested in hiring good analysts of any kind, because "security can be learned." The departing execs are not among the three that sold off $1.8 million in shares days after the company discovered the breach. The company's shares have dropped by around a third since the breach was disclosed, the AP notes. Democratic senators introduced a bill Friday that would ban Equifax from profiting from the breach by charging for credit freezes. At Bloomberg, the editorial board argues that Equifax should be dealt with under existing legislation, which allows the Consumer Financial Protection Bureau to "penalize companies for failing to make 'reasonable' efforts to keep sensitive information out of the wrong hands." (For two months, Equifax failed to fix the known security hole that hackers exploited.)