Equifax: Retail Credit Gossip Files, Apache Struts and 147 Million Records

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Equifax began in Atlanta in 1899 as the Retail Credit Company, founded by brothers Cator and Guy Woolford to provide risk reports for insurers and employers. By the 1960s its local inspectors were interviewing landlords, grocers and employers and filing rumors about people's marriages, sex lives and politics, with negative findings rewarded. When the files were computerized around 1970, public outrage and congressional hearings produced the Fair Credit Reporting Act, and in 1975 the company renamed itself Equifax. It grew into one of the big three credit bureaus, with $5 billion or more in 2024 revenue, over 14,000 employees and data on more than 800 million consumers and 88 million businesses.

In late 2016 a researcher found an exposed employee portal, which stayed open for six months. Between May and July 2017 attackers exploited a known Apache Struts flaw, stayed inside the network for 134 days and took records of about 147.9 million Americans. The U.S. Justice Department indicted four members of China's People's Liberation Army, and China denied it. An Argentine portal used admin as both username and password, the official site served malware, and the IRS suspended a $7.2 million contract. Former CIO Jun Ying and manager Sudhakar Reddy Bonthu pleaded guilty to insider trading. Promised $125 payouts from a $700 million settlement were diluted, while class lawyers received about $77.5 million.

• Its acquisitions include Anakam, a pioneer of SMS two-factor authentication, and Veda in Australia.
• The Work Number sells salary and employment histories to banks, background checkers and agencies.
• Consumers filed over 57,000 complaints with the CFPB between October 2012 and September 2017.
• Julie Miller of Oregon won an $18.6 million jury award after her file was merged with a stranger's, later reduced by a judge.
• In 2022 Equifax sent miscalculated scores to lenders the same week CEO Mark Begor received a $25 million package.