EQUIFAX INC.

Equifax disclosed a 2017 cybersecurity incident involving unauthorized access to its systems, resulting in the theft of personal information (PII, identity, IP) from consumers in the US, Canada, and UK. The attack exploited a public-facing application, leading to data exfiltration and encryption (ransomware). The incident was resolved, and the company implemented enhanced security controls, including MFA and employee training.

Equifax filed a supplemental notice with the New Hampshire Attorney General on October 12, 2017, updating the scope of the July 2017 breach. The incident, caused by exploitation of a web application vulnerability, impacted approximately 145.5 million U.S. consumers, including 634,614 New Hampshire residents. Data exposed included names, SSNs, DOBs, addresses, and driver's license numbers. Equifax engaged Mandiant for forensics and offered credit monitoring.

Equifax filed a supplemental breach notice in South Carolina on October 13, 2017, covering 2.5 million additional U.S. consumers. The breach involved unauthorized access via exploitation of a web application vulnerability between mid-May and July 2017. Data exposed included names, SSNs, birth dates, addresses, and some credit card numbers. Equifax engaged forensic investigators and notified law enforcement.

Equifax Inc. notified California residents of a supplemental determination regarding its 2017 data breach. Criminals exploited a website application vulnerability to gain unauthorized access to personal information from mid-May through July 2017. Equifax discovered the intrusion on July 29, 2017. This notice specifically addresses approximately 2.4 million additional U.S. consumers whose partial driver's license information was confirmed impacted, bringing the total nationwide affected count to approximately 147.9 million. The data involved names, driver's license numbers, dates of birth, and in some cases addresses. Equifax offered 12 months of identity theft protection and credit monitoring.

Equifax, Inc. filed a supplemental notice with the Washington Attorney General regarding a cybersecurity incident. The breach, caused by the exploitation of a web application vulnerability, occurred from May 16 to July 31, 2017, and was discovered on July 29, 2017. The incident impacted approximately 145.5 million U.S. consumers, including 3,243,664 Washington residents. Data exposed included names, SSNs, birth dates, addresses, driver's license numbers, and credit card numbers. Equifax engaged Mandiant for forensic investigation and offered free credit monitoring.

Equifax Inc. notified New Hampshire AG of a cybersecurity incident discovered July 29, 2017, where criminals exploited a web application vulnerability to access files. Approximately 143 million U.S. consumers affected, including 622,558 NH residents. Data included names, SSNs, DOBs, addresses, driver's licenses, and some credit card numbers. Equifax engaged forensic investigators, notified law enforcement, and offered one year of free credit monitoring.

Equifax Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2017-09-07. The breach occurred during 5/13/2017 - 7/30/2017. The breach was discovered on 7/29/2017. 143,000,000 individuals were affected. Notice was sent on 9/7/2017.

Equifax, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2017-09-07. 2,982,421 Massachusetts residents were affected. The report records the breach type as electronic.

Equifax reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2017-02-09. 3 Massachusetts residents were affected. The report records the breach type as electronic.

Equifax Consumer Services LLC notified the NH Attorney General of a data security incident affecting 1 NH resident. On Jan 6, 2017, LifeLock reported a member could view another's credit report. Equifax determined credit info for 158 LifeLock members was inadvertently sent to another member's portal due to a technical issue, not malicious activity. Notifications were mailed on Feb 8, 2017, and LifeLock subscriptions were extended for 12 months.

Equifax, a third-party vendor for Rite Aid, experienced an insider threat incident where a former employee misused access privileges to reset accounts and access PII (SSN, payroll info) of Rite Aid employees. The incident occurred Jan-Feb 2015. Rite Aid notified NH AG on June 5, 2015. Affected individuals received notification and credit monitoring services.

Equifax Information Services reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2015-04-08. 19 Massachusetts residents were affected. The report records the breach type as both.

Equifax notified the New Hampshire Attorney General on April 2, 2015, of a data incident affecting one NH resident. On March 15, 2015, Equifax discovered a technical error during a software change that resulted in the inadvertent mailing of one resident's PII (including SSN and account numbers) to incorrect individuals. Equifax addressed the error, attempted to retrieve the data, and offered one year of ID Patrol protection.

Equifax, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2014-03-11. 34 Massachusetts residents were affected. The report records the breach type as electronic.

Equifax reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2012-12-21. 16 Massachusetts residents were affected. The report records the breach type as electronic.

Equifax, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2010-08-02. 20 Massachusetts residents were affected. The report records the breach type as electronic.

Equifax, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2010-07-01. 3 Massachusetts residents were affected. The report records the breach type as electronic.

Equifax Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2010-04-05. 1 Massachusetts residents were affected. The report records the breach type as electronic.

Equifax Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2010-03-22. 2 Massachusetts residents were affected. The report records the breach type as electronic.

Equifax Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2010-02-18. 79 Massachusetts residents were affected. The report records the breach type as paper.

Equifax notified the NH Attorney General of a security incident involving 14 NH residents. On Jan 19, 2010, Equifax discovered that W-2 forms mailed to employees via a payroll vendor had SSNs visible through the envelope window. Equifax notified affected employees and offered one year of free credit monitoring.