GAO: Equifax spent $200M on security upgrades after 2017 data breach

Sept. 7 (UPI) -- The independent investigative arm of Congress issued a report Friday detailing the actions taken over the past year by credit reporting agency Equifax, in response to a major data breach that affected tens of millions.

The Government Accountability Office said in the 35-page report Equifax's stock price and quarterly revenues have mostly recovered from the breach, which that compromised the personal information of as many as 150 million people.

The GAO analysis detailed the steps Atlanta-based Equifax has taken since the breach to prevent similar attacks in the future. Last year, hackers had found a vulnerability in Equifax servers that gave them access to customer login credentials.

The report said the hackers hid in Equifax's system for more than two months and mined data for credit card numbers, drivers licenses and social security numbers. The breach led the agency to make $200 million in security upgrades.

"We have enhanced our leadership team to include some of the most experienced cybersecurity and technology professionals in the industry," an Equifax spokesman told Bloomberg.

Several U.S. government agencies, including the Internal Revenue Service and Social Security Administration, use Equifax and have conducted separate assessments of the company's security. They directed Equifax to address lower-level technical concerns -- and the IRS terminated one of its contracts with Equifax, the GAO report said.

Investigations by the Federal Trade Commission and Bureau of Consumer Financial Protection have not yet been completed.

Sen. Elizabeth Warren, D-Mass, has been an outspoken critic of Equifax since the breach and requested the GAO investigate.

"One year after they publicly revealed the massive 2017 breach, Equifax and other big credit reporting agencies keep profiting off a business model that rewards their failure to protect personal information," Warren said in a statement.

New legislation will require credit reporting firms to offer free credit freezes for customers, a reversal of regulations outlined in the Dodd-Frank Act.

"Like many people, I tried to freeze my credit after the hack. It was a difficult (& painfully boring) process. I introduced the FREE Act to let people access & freeze their credit file at no cost," Warren tweeted.

Millions of people use Equifax to check their credit and experts say it may see a record profit this year. It's one of the three major reporting agencies, with Experian and TransUnion.

"It was certainly a bump in the road, but it doesn't look like anything else is going to dramatically change the future," analyst Brett Horn told Bloomberg.