Speaker 1: Outrage, disbelief, confusion just a few of the things many
Speaker 1: Americans are feeling after learning that their names, social security numbers,
Speaker 1: birth dates, addresses, and driver's license numbers are potentially in
Speaker 1: the hands of hackers. Equifax, a credit monitoring company with
Speaker 1: a database of America's personal information, was hacked in the
Speaker 1: largest data breach involving social security numbers in history one
Speaker 1: forty three million consumers. Equifax has set up a website
Speaker 1: and here's part of what you'll hear if you call
Speaker 1: its eight hundred number to freeze your credit information. Welcome
Speaker 1: to the Equifax Automated Security Freeze System. This automated system
Speaker 1: would allow you to place, temporarily, lift or permanently remove
Speaker 1: a security freeze from your Equifax credit file in accordance
Speaker 1: with your individual states file freeze law. There may be
Speaker 1: a charge, but here's part of the problem. To better
Speaker 1: serve you, the following information will be required in order
Speaker 1: to comp lead your request. Your state, numeric portion of
Speaker 1: your current address, and social Security number. But do you
Speaker 1: really want to give Equifax this information? Again? Here to
Speaker 1: discuss the repercussions of this hack are two experts in cybersecurity.
Speaker 1: Eric Gordon, A professor at the University of Michigan Ross
Speaker 1: School of Business, and Craig Newman, a partner at Patterson Belknap. Eric.
Speaker 1: Equifax said criminals gained access to certain files in the
Speaker 1: company's system by exploiting a weak point in website software,
Speaker 1: but there's no evidence of unauthorized activity on its main
Speaker 1: consumer or commercial credit reporting databases. Interpret that for us,
Speaker 1: what does it mean? Yeah, it means somebody obviously a
Speaker 1: bad person. I mean, my mother didn't do this. Has
Speaker 1: information on a hundred and forty three million of us
Speaker 1: and so far, as far as Equifax knows, it hasn't
Speaker 1: been used. That information hasn't been used in a bad way. Now,
Speaker 1: you can guess that it's only a matter of time
Speaker 1: until Equifax discovers this or we discover this. But you know,
Speaker 1: does anybody believe this information was taken for anything other
Speaker 1: than bad purposes? Eric? Are they saying that anything about
Speaker 1: their security system when they're saying exploiting a weak point
Speaker 1: in website software? Yeah, it gives you some idea of
Speaker 1: how the entrance happens. Are they different entry points into
Speaker 1: these databases? Uh? And they've told us what they what
Speaker 1: they think the entry point was it was on the website.
Speaker 1: So so for people who you know, are actually sort
Speaker 1: of into the technology of this, it does give a
Speaker 1: clue as to what where it happened, not necessarily how
Speaker 1: it happened, Eric, I mean, Craig, excuse me, Craig. This
Speaker 1: is a huge breach obviously, but just if people are
Speaker 1: worried about what exactly has been exposed here, can you
Speaker 1: take us through some of the details of what got
Speaker 1: you know, what got hacked? Sure, Michael, Yeah, it's very difficult,
Speaker 1: based on what we know now to really figure out
Speaker 1: what information has been affected, because if you look at
Speaker 1: the public disclosures that Equifax has made, they've said that quote,
Speaker 1: certain files have been accessed and potentially dred and forty
Speaker 1: three million Americans have been affected. So it's it's almost
Speaker 1: you don't know what you can't see because we don't
Speaker 1: have all that much information. I think that's why, you know,
Speaker 1: consumers are scrambling and are kind of up in arms
Speaker 1: over the way this has been handled. But at the
Speaker 1: same time, all the companies, the data contributors that provide
Speaker 1: the information that makes Equifax and the other monitoring services go,
Speaker 1: they're also scrambling at the same time because they've got
Speaker 1: their own legal obligations. So you've got coming at both sides. Eric,
Speaker 1: this is the third time in two years that Equifax
Speaker 1: has been hacked, not quite as badly the last two times.
Speaker 1: But did it improve its security following those other hacks?
Speaker 1: Did it put in more layers? You know, I don't
Speaker 1: know that for a fact, but I'm going to guess
Speaker 1: that they did, because the history of hacking is this
Speaker 1: is this sort of escalation thing where you escalate your defenses,
Speaker 1: they hackers escalate their capabilities. So you know, on on Monday,
Speaker 1: the good guys might be ahead. That is well, I
Speaker 1: don't know if Equifax is the good guy, but Equifaxes
Speaker 1: defenses might be stronger on Tuesday, the hackers ability to
Speaker 1: attack might be stronger. This is just an endless and
Speaker 1: endless cycle. And um, as far as you know, Craig,
Speaker 1: are there multiple layers of security at Equifax? We really
Speaker 1: don't know. I mean, you would think that a company
Speaker 1: that has the proverbial keys to the kingdom would have
Speaker 1: what we call layered security, and that's you know, firewalls,
Speaker 1: internal intrusion detection, and all sorts of kind of the
Speaker 1: latest bells and whistles to make sure you're keeping this
Speaker 1: information safe. But again we don't know exactly what Equifax
Speaker 1: or the other credit monitoring companies have. You would think, however,
Speaker 1: that given the value of these massive warehouses of information
Speaker 1: that they keep, that they would have pretty sophisticated layer security.
Speaker 1: The hack of Equifax, a credit monitoring company, was the
Speaker 1: largest data breach in history involving social security numbers. Cyber
Speaker 1: Scout founder Adam Levin explains why that makes this hack
Speaker 1: so serious. The problem is that the social security number
Speaker 1: is the scalon key to our identities, and when that's stolen,
Speaker 1: we're in a position where we're going to have to
Speaker 1: be lucky over our shoulders for the rest of our lives.
Speaker 1: We've been discussing this hack with Eric Gordner, professor at
Speaker 1: the University of Michigan Ross School of Business, and Craig Newman,
Speaker 1: a partner at Better Patterson Belknap. Craig, there's all kinds
Speaker 1: of advice out there. Do you have any advice about
Speaker 1: what people should do? Now? Look, it's the most important
Speaker 1: thing at this point is to put a credit freeze
Speaker 1: in with all the credit reporting agencies, and it's all
Speaker 1: three of them. Because you want to prevent any sort
Speaker 1: of criminal from opening an account, taking out a loan,
Speaker 1: or doing anything in your name, and the way to
Speaker 1: do that is to put a credit freeze on your account. Eric.
Speaker 1: One of the things that was most remarkable in the
Speaker 1: news after all this happened was the news that to
Speaker 1: seen two executives at Equifax sold a lot of stock
Speaker 1: shortly after learning about the breach. What's the story worry
Speaker 1: on this and and how could something like that end
Speaker 1: up happening? Well, it could end up happening innocently. It
Speaker 1: could have been a sale they planned in advance. But
Speaker 1: it looks terrible. Looks terrible because of this. It turns
Speaker 1: out this hack apparently went on from mid May to July,
Speaker 1: and somehow Equifax didn't discover it, But they discovered it
Speaker 1: on July twenty nine and waited until last Thursday. They
Speaker 1: waited almost six weeks to make that news public. But
Speaker 1: Insider sold something like one point eight million dollars of
Speaker 1: their stock right away, So they got to do something
Speaker 1: that may have helped themselves that the rest of us
Speaker 1: didn't get to do. So, even though it could be
Speaker 1: perfectly innocent, it could have been a preplanned sale. It
Speaker 1: sure looks terrible to the other hundred and forty three
Speaker 1: million of US something I'm sure the SEC will be
Speaker 1: looking into as well as the SEC Craig. There are
Speaker 1: so many agencies involved in this, the FTC doing investigation,
Speaker 1: state attorneys general, they are going to be multiple congressional inquiries.
Speaker 1: Will this help security in the future, Well, this breach, June,
Speaker 1: it's it's bigger than than Equifax, because you're talking about
Speaker 1: big data and how these stockpiles of information are safeguarded
Speaker 1: really in the face of a really sophisticated threat environment.
Speaker 1: And at the same time, the growth of big data
Speaker 1: and these these warehouses of information just keeps leaping and growing.
Speaker 1: So you have really a collision of these two interests
Speaker 1: and that's really going to be the story um with Equifax.
Speaker 1: But you know, you're also going to have You've got
Speaker 1: two class actions already, You've got the New York Attorney General,
Speaker 1: You're going to have the usual course of cries for
Speaker 1: congre sational hearings. But the real question is is this
Speaker 1: going to become a teachable moment where people sit up
Speaker 1: and take notice and say, this is a really significant hack. Eric,
Speaker 1: you know in addition to all the investigations that obviously
Speaker 1: have to go on, and we'll go on here, there
Speaker 1: are a couple of class action lawsuits that have already
Speaker 1: been filed. Um, what kind of liability does that does
Speaker 1: Equifax face here? Uh, you know, under the law for
Speaker 1: having you know, given the sheer amount of data we've
Speaker 1: got out having been breached. Yeah, I think they face
Speaker 1: serious liability that's going to be measured in billions. That's
Speaker 1: with the b and they're gonna be three groups that
Speaker 1: come after them. The obvious group is the people whose
Speaker 1: data was stolen, but they're not the only ones. You're
Speaker 1: gonna see class actions from shareholders and Equifax who are
Speaker 1: going to sue the officers and directors, which is the
Speaker 1: same as suing Equifax in the end um for um
Speaker 1: for you know, some kind of breach of duty. You're
Speaker 1: also going to see credit card issuers, the banks, the
Speaker 1: stores that actually issue credit cards come after Equifax because
Speaker 1: they're going to have to issue you know, millions and
Speaker 1: millions and millions of new credit cards, so they're going
Speaker 1: Equifax is going to be facing lawsuits in a lot
Speaker 1: of courts from a lot of people. And uh, you know,
Speaker 1: we we know from the prior the prior ones, the
Speaker 1: home depots, the targets that they're they're going to end
Speaker 1: up settling, and it's going to be big amounts Greig
Speaker 1: have there there are three major credit reporting companies. Have
Speaker 1: the two others ever been hacked? Well, one of the
Speaker 1: other's experience had to hack two years ago. And but
Speaker 1: in terms of just sheer numbers, I think it was
Speaker 1: about fifteen or eighteen million consumers that were affected, So
Speaker 1: those were relatively minor compared to Equifax, where you have
Speaker 1: the potential you know, is Eric noted, you have the
Speaker 1: potential of will belye the largest class action lawsuit ever
Speaker 1: withd percent of the American population as class members, and
Speaker 1: Eric is there. Is it just impossible to stop these hacks?
Speaker 1: It just it seems, I mean, the government has been hacked,
Speaker 1: has been so many hacks, is it impossible to stop them?
Speaker 1: I mean, ironically, the other big Social Security hack was
Speaker 1: a government site office of Personnel Management. I don't think
Speaker 1: it's possible to stop them. But you know, the law
Speaker 1: doesn't require won't probably won't require you to be perfect.
Speaker 1: But I think what the law is going to evolve
Speaker 1: to require at least for people like credit agencies that
Speaker 1: have Social Security numbers, birth dates. Things that can haunt
Speaker 1: you forever is that you show that you did everything
Speaker 1: that was the state of the art at the time. Uh.
Speaker 1: And if you did anything less, I think you're going
Speaker 1: to be in trouble. I think what the law needs
Speaker 1: to do is to make the penalties designed in such
Speaker 1: a way that every company that has really sensitive data
Speaker 1: spends whatever money it takes. Not to stop you there, Eric,
Speaker 1: but we'll be back to this topic. Thank you both.
Speaker 1: That's Eric Gordon, a professor at the University of Michigan
Speaker 1: rass School of Business, and Craig Newman, a partner at
Speaker 1: Patterson Belknap, coming up on Bloomberg law. Google appealing a
Speaker 1: record fine from the EU to the highest court in
Speaker 1: the EU. This is Bloomberg