Despite data breach, Equifax likely to escape corporate death penalty


Equifax couldn’t protect the personal data of millions of Americans, but the company may yet successfully defend itself.

The massive data breach announced Sept. 7 did untold damage to individual consumers and the nation’s financial system, enough for some experts to take seriously the possibility of a corporate death penalty, but most say the odds favor survival for the Atlanta-based, $3.4 billion-a-year, 9,900-employee firm.

Still, there are precedents — a number of companies have stumbled badly and publicly.

Arthur Andersen, the once-proud accounting giant, was effectively put out of business in 2002 by regulators following its enabling of Enron deceit about its losses. Lehman Bros., which ran out of money after billions of dollars in housing loans went bad, was deemed so important to the financial system in 2008 that it was saved from extinction with a government-shaped takeover.

Then again, companies from Target to Home Depot to Yahoo have suffered massive data breaches and come through the storm virtually unscathed.

What is most harmful to Equifax might be the way the data breach was an attack on its core mission – collecting and protecting data. Unlike the hacking of retailers like Target or Home Depot, where data was collected as part of the business, collecting data at Equifax is the business.

It is still too early to predict which path Equifax will take, said Humayun Zafar, professor of information security at Kennesaw State University. “Each of those is a potential outcome and you could argue for any of the options.”

Wall Street seems to be betting that the company will be damaged, but survive.

For starters, Equifax is the biggest component in a sector that is essential to the financial system – a gatekeeper and judge for billions of dollars in loans each week. Without the credit agencies, consumers might not get car loans and mortgages: Lenders need the agencies to look at the data and tell them whether their loans are likely to be repaid.

Anti-trust concerns make a takeover by a rival unlikely. Moreover, unlike Andersen with Enron, Equifax actions – at least so far – have not shown a habitual disregard for the truth.

Just a reluctance to say it out loud: the breach apparently took place in May and was discovered by Equifax in late July. The company finally announced the problem in September. During the next six trading days, Equifax stock plunged 35 percent. Since then, shares have bounced back, but are still 23 percent off that previous level.

While the public has become used to news of data breaches, the information pouring out of Equifax was deeper, more personal and more long-lasting than accounts stolen from retailers. And its management of the crisis was clumsy at best.

Consumers were not told of the problem until months after their personal data had been compromised. Then they found out that three top executives had sold nearly $2 million in stock early August day, around the time the company told the FBI of the breach.

In contrast, companies like Home Depot and Target were quicker to announce data breaches and offer consumers free credit monitoring, Zafar said. “Target’s handling of its problem was textbook. It was exactly as you’d want to handle things. Equifax was also textbook. As in, this is what you should not do.”

The company was warned by the Department of Homeland Security in early March of a vulnerability in its software. A fix was suggested, but Equifax did not make the fix. The database was apparently breached later that month, although the company was unaware of the attack until July.

Equifax notified the FBI in August and announced the breach publicly a month later.

Equifax set itself on a dangerous, potentially self-damaging course right at the start, said Carol Cookerly, president of Cookerly Public Relations & Marketing, who said she has not worked for Equifax, but has advised many other companies on handling a crisis.

“Probably the single most damaging aspect of a crisis is when the company doesn’t realize its responsibility or think it’s responsible,” she said. “Any kind of evasion means that the politicians and regulators and public will double down on their pursuit of you.”

But she thinks the company’s recent efforts to make amends the willingness to accept responsibility,  and the offering a year of free credit monitoring  give it a good chance of repairing the damage, perhaps within a few months. She compared the crisis to a horse race.

“It doesn’t matter if they stumble coming out of the gate, it matters what happens in the last furlong,” Cookerly said.

After the first wave of angry reaction, the company announced the retirement of two executives.

CEO Richard Smith also retired.

Other factors – besides the company’s upgraded approach – also seem to point at a much more positive endgame for Equifax.

“It’s a very tempting comparison, but there are important differences between Andersen and Equifax,” said Kevin Crowley, adjunct professor at Emory’s Goizueta Business School and former investment banker. “I don’t see it playing out the way Arthur Andersen did.”

But regulators and Congress have barely started scrutiny of Equifax. There are also lawsuits in the works – potentially including damage and payment to 145 million plaintiffs.

Equifax no-doubt has insurance, but not necessarily enough to cover all judgments, Crowley said. “What is unknown is what the cost of all this will be.”

Those uncertainties hold back many of those who might take a hand in the fate of Equifax, especially big investors and other huge financial companies, he said. “There are just too many things in motion.”

That is a “seismic” event, said Campbell Harvey, finance professor at Duke University’s Fuqua School of Business. “How viable is their business model, when the model depends on trust? The information they have is highly confidential, so people need to be able to trust them. And now, they can’t.”

There are developing technologies that might provide better security, he said.

But in the meantime, pretty much every company with a database – that is, every company – faces the same question.

So ultimately, the fate of Equifax really can’t be separated from larger questions about the way the United States handles and protects data, Harvey said. “How many times are these giant company breaches going to happen before we actually do something about it?”

MYAJC.COM: REAL JOURNALISM. REAL LOCAL IMPACT.

AJC Business reporter Michael E. Kanell keeps you updated on the latest news about jobs, housing and consumer issues in metro Atlanta and beyond. You'll find more on myAJC.com, including these stories:

Never miss a minute of what's happening in local business news. Subscribe to myAJC.com. 



Reader Comments ...


Next Up in Business

Cyber security fears spark training, hopes for lots of Georgia jobs
Cyber security fears spark training, hopes for lots of Georgia jobs

Even Georgia’s first lady worries about cyber attacks. “I keep telling her that’s not going to happen; we don’t have enough money for them to fool with,” Gov. Nathan Deal quipped before cutting the ribbon on the new $100 million Georgia Cyber Center in Augusta the other day. He fished out his pocketknife when giant ceremonial...
Three Atlanta sports teams suspend Papa John’s affiliation
Three Atlanta sports teams suspend Papa John’s affiliation

Three Atlanta sports teams are reevaluating their partnerships with Papa John’s after the company’s founder admitted to using racist language.   The Atlanta Falcons and Atlanta United suspended their relationship with Papa John’s Pizza following reports John Schnatter used a racial slur during a conference call in May, a...
Toy stores, makers face life after Toys ‘R’ Us
Toy stores, makers face life after Toys ‘R’ Us

Buckhead-based toy store Kazoo Toys knows what its customers want. In fact, customers sometimes even call ahead, ownder Joe Novak said, telling Kazoo information about a child they are buying a present for. When the person arrives, the employees can have a product already picked out and wrapped. “There is a passion in local toy store owners you...
Atlanta real estate: Home prices rise strongly
Atlanta real estate: Home prices rise strongly

Home prices continued their long rise as summer began, according to a report the Atlanta Realtors Association. The median price of a home sold in metro Atlanta during June was $285,000 – a jump of 7.5 percent from the same month a year ago, the group said. Higher prices are a sign of strong demand, said Bill Murray, president of the Atlanta Realtors...
Delta to trim growth plans for flights this fall
Delta to trim growth plans for flights this fall

High fuel costs are translating into higher air fares for Delta Air Lines and other U.S. carriers. Atlanta-based Delta announced Thursday it will trim its flight schedule for this fall as it grapples with the rising price of oil. The airline plans to focus on under-performing routes when making its cuts. That means some flights booked for fall travel...
More Stories