With regard to identity verification, CRAs typically use information they  collect to generate questions that federal agencies and other entities can  use to test applicants’ knowledge of information in their credit file. Federal Agencies Oversee CRA Activities, Including Protection of Personally Identifiable Information

CRAs have been subject to federal regulation since the passage of the  Fair Credit Reporting Act in 1970. On July 29,  2017, Equifax discovered the breach and reported that it took actions to  address the factors that allowed the attackers to successfully gain access  to its network. Based on its cybersecurity consultant’s analysis and recommendations  following the breach, Equifax determined that several major factors had  facilitated the attackers’ ability to successfully gain access to its network  and extract information from databases containing PII. Detection. Segmentation. Equifax Reported Taking Steps to Identify Affected Individuals

Following the shutdown of its online dispute portal, Equifax took steps to  identify what data had been lost and the number of individuals affected so  that it could fulfill its responsibility to notify affected individuals. Equifax did not ask the Department of Homeland Security  (DHS), which is the central agency that responds to cyber incidents  across the federal government, to assist in responding to the breach. Major Federal Customers of Equifax Took Steps to Ensure Their Activities Were Not Adversely Affected by the Breach

IRS, SSA, and USPS—large agencies that were major customers of  Equifax at the time of the breach—assessed the potential impact of the  breach to their own operations as well as to the operations of their  consumers. Modified contracts with Equifax. Canceled a short-term contract with Equifax. Before the Equifax  breach, Equifax was the incumbent contractor at IRS for taxpayer  identity and verification services. However, according to  officials at both organizations, Equifax notified DHS officials that the  company had already retained professional services from a private  cybersecurity consultant and, thus, declined assistance from DHS. In addition, BCFP, DHS, FTC, IRS, SSA, USPS, and  Equifax provided technical comments orally and via email, which we have  incorporated, as appropriate. At that time, we will send copies to the appropriate  congressional committees, Equifax, and to the Acting Director of the  Bureau of Consumer Financial Protection; the Chairman of the Federal  Trade Commission; the Secretary of the Department of Homeland  Security; the Commissioners of the Internal Revenue Service and Social  Security Administration; and the Postmaster General of the United States. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) summarize the events regarding the 2017  Equifax breach and the steps taken by the company to assess, respond  to, and recover from the incident and (2) describe the actions that federal  customers and oversight agencies took in response to the breach. We also reviewed Equifax’s relevant public  filings to the Securities and Exchange Commission and statements it  provided to the public and shareholders, which included information about  the data breach and the company’s efforts for remediation. Further, we conducted a site visit to the Equifax data center in Alpharetta,  Georgia, to interview knowledgeable officials, such as the interim Chief  Security Officer and other officials knowledgeable about how Equifax  stores and processes data, and observed physical security measures. We also selected and reviewed contracts between Equifax and each of  the three selected agencies—IRS, SSA, and USPS—to determine what  changes were made to services, such as identity-proofing solutions,  provided by Equifax to federal agencies as a result of the breach.
Why GAO Did This Study

CRAs such as Equifax assemble information about consumers to produce credit reports and may provide other services, such as identity verification to federal agencies and other organizations. Data breaches at Equifax and other large organizations have highlighted the need to better protect sensitive personal information.
GAO was asked to report on the major breach that occurred at Equifax in 2017. This report (1) summarizes the events regarding the breach and the steps taken by Equifax to assess, respond to, and recover from the incident and (2) describes actions by federal agencies to respond to the breach. To do so, GAO reviewed documents from Equifax and its cybersecurity consultant related to the breach and visited the Equifax data center in Alpharetta, Georgia, to interview officials and observe physical security measures. GAO also reviewed relevant public statements filed by Equifax. Further, GAO analyzed documents from the IRS, SSA, and USPS, which are Equifax's largest federal customers for identity-proofing services, and interviewed federal officials related to their oversight activities and response to the breach.

What GAO Found

In July 2017, Equifax system administrators discovered that attackers had gained unauthorized access via the Internet to the online dispute portal that maintained documents used to resolve consumer disputes (see fig.). The Equifax breach resulted in the attackers accessing personal information of at least 145.5 million individuals. Equifax's investigation of the breach identified four major factors including identification, detection, segmenting of access to databases, and data governance that allowed the attacker to successfully gain access to its network and extract information from databases containing personally identifiable information. Equifax reported that it took steps to mitigate these factors and attempted to identify and notify individuals whose information was accessed. The company's public filings since the breach occurred reiterate that the company took steps to improve security and notify affected individuals.
The Internal Revenue Service (IRS), Social Security Administration (SSA), and U.S. Postal Service (USPS)—three of the major federal customer agencies that use Equifax's identity verification services—conducted assessments of the company's security controls, which identified a number of lower-level technical concerns that Equifax was directed to address. The agencies also made adjustments to their contracts with Equifax, such as modifying notification requirements for future data breaches. In the case of IRS, one of its contracts with Equifax was terminated. The Department of Homeland Security offered assistance in responding to the breach; however, Equifax reportedly declined the assistance because it had already retained professional services from an external cybersecurity consultant. In addition, the Bureau of Consumer Financial Protection and the Federal Trade Commission, which have regulatory and enforcement authority over consumer reporting agencies (CRAs) such as Equifax, initiated an investigation into the breach and Equifax's response in September 2017. The investigation is ongoing.

What GAO Recommends

GAO is not making recommendations in this report. GAO plans to issue separate reports on federal oversight of CRAs and consumer rights regarding the protection of personally identifiable information collected by such entities. A number of federal agencies and Equifax provided technical comments which we incorporated as appropriate.