Discussion Questions 1. How would you classify Equifax's ethical climate?Can you identify ONE ethical safeguard Equifax discussed in the text that could adopt to help improve the ethical climate and help reduce the likelihood of an incident like this from occurring in the future?

--------------------------------------------------------

Discussion Case: Equifax's Data Breach

The credit reporting company Equifax was at the center of a massive data breach affecting over 145 million customers. In 2017, hackers took advantage of a vulnerability in Equifax's website software and stole the personal information, including names, addresses, and Social Security numbers, of as many as 145 million Americans. A separate but related incident at Equifax involved 15 million British citizens who had their records violated from 2011 to 2016. The failure of Equifax's internal reporting and control measures led to a widespread violation of peoples' rights to the privacy of their personal information and became a huge public relations crisis for the company. Equifax's top lawyer, John Kelley, was investigated by the board of directors for his possible involvement in a cover-up of the hack and his mishandling of the situation. Kelley was responsible for approving the sales of company stock by executives after the breach was discovered, but before it had been revealed to the public. Upon the disclosure of the breach, company stock price fell 14 percent. Investors sold approximately $4.5 billion (25 percent) of the company's market value after the hack was made public. More than 10 million Americans had their driver's license data exposed during the hack. Many people who had provided their driver's license information to the company were simply verifying their information in order to receive credit reports and ratings from Equifax. Some had entered their information on the company's web page in an effort to settle credit report disputes. The credit report dispute web page had been particularly vulnerable to security breaches. Equifax CEO Richard Smith admitted during congressional Chapter 6 Organizational Ethics 133 Final PDF to printer 134 Part Two Business and Ethics law43665_ch06_115-136.indd 134 11/14/18 01:42 PM hearings that he and other executives had been aware of the security weaknesses, but that a single employee at the firm had not properly heeded security warnings and did not ensure the implementation of software fixes. Smith added that there was a failure in their software systems designed to scan for the absence of "patches" necessary to protect private information. Other internal control mechanisms at Equifax appeared to have been either ignored or dysfunctional. Frederick Lemieux, director of Georgetown University's graduate program in Applied Intelligence, blamed the breach on what he called "passive complicity" in the firm's culture. (Complicity means being involved in wrongdoing; passive complicity implies that executives were guilty of wrongdoing by not actively preventing it.) That top executives seemed to worry more about their own stock portfolios than the security of their customers' personal information was troubling to many ethics experts. Observers also criticized the company for its delay in going public about the breach. Finally, it appeared that knowledge of the potential for hacking was isolated to only one employee. A more robust system where multiple individuals were responsible for preventing a problem might have avoided the hack. Unlike banks, credit reporting agencies are relatively lightly regulated, and they typically rely on internal systems to maintain security. Lemieux stated, "there is no incentive to comply with the best industry practices and no incentives to spend [funds on these programs] because you're not accountable for it." He noted that credit reporting agencies did not face the same financial or legal consequences that banks or other businesses, like Target or Home Depot, encountered when hacked. Pamela Pressman, president of the Center for Responsible Enterprise and Trade, said that the breach should remind Equifax and other firms to train their employees and raise awareness about proper "cyber hygiene . . . ensuring that your employees, your contractors, your vendorsthose people that have access to your network and your dataunderstand their role in protecting the network and protecting the data." The cyberattack on Equifax was potentially more dangerous than other hacks in recent history because credit-reporting agencies played a significant role in determining who received financing and ultimately, how much credit they received. The data collected by these agencies was needed for applying for credit cards, loans, and background checks. The attack was conducted in one major maneuver, which facilitated the hackers' ability to use the data for their own purposes. This breach could lead to problems for small financial institutions, like community banks and credit unions, which typically relied on information collected by the credit-reporting firms to determine their loan decisions. Larger financial institutions were more likely to collect additional information from applicants, which made them less vulnerable. Days after the company discovered the breach, CFO John Gamble and two other top Equifax executives reportedly sold a combined $1.8 million worth of shares of the company, but all three denied knowing of the hack when they made the transactions, despite evidence to the contrary. CEO Smith stepped down from his post following these events. Smith had been in charge since 2005. The Federal Bureau of Investigation investigated Equifax's handling of the situation as well as the actions of the top executives. When testifying before Congress, Smith downplayed the severity of the situation and the factors that facilitated the breach. He repeatedly blamed an IT worker who did not implement software remedies after Equifax executives had been warned of possible holes in Equifax's website security by the U.S. Department of Homeland Security. Equifax hired FireEye's Mandiant group to investigate the breach. The Mandiant report determined that approximately 2.5 million additional U.S. consumers were potentially Final PDF to printer Chapter 6 Organizational Ethics 135 law43665_ch06_115-136.indd 135 11/14/18 01:42 PM impacted, for a total of 145.5 million. Mandiant did not identify any evidence of additional or new attacker activity or any access to new databases or tables. Instead, this additional population of consumers was confirmed during Mandiant's completion of the remaining investigative tasks and quality assurance procedures built into the investigative process. The review also has concluded that there is no evidence the attackers accessed databases located outside of the United States. Equifax claimed they learned of hacking activity in May 2017, but the Mandiant report said the hack started two months earlier. Company executives did not formally disclose the breach until September 2017, however. They admitted that the hack was conducted from May through July 2017. The identity of the hackers was never disclosed.

Sources: "The Morning Risk Report: Equifax Breach Could Spur New Round of Training," The Wall Street Journal, September 11, 2017, www.wsj.com; "How to Explain the Equifax Breach? Start with the Culture," Georgetown University, September 15, 2017, ses.georgetown.edu; "Equifax CEO Richard Smith to Exit Following Massive Data Breach," The Wall Street Journal, September 26, 2017, www.wsj.com; "At the Center of the Equifax Mess: Its Top Lawyer," The Wall Street Journal, October 1, 2017, www.wsj.com; "2.5 Million More People Potentially Exposed in Equifax Breach," The New York Times, October 2, 2017, www.nytimes.com; "Equifax Announces Cybersecurity Firm Has Concluded Forensic Investigation Of Cybersecurity Incident," Equifax website, October 2, 2017, investor.equifax.com; and "Equifax Breach Caused by Lone Employee's Error, Former CEO Says," The New York Times, October 4, 2017, www.nytimes.com.