Case | HBS Case Collection | October 2017 (Revised April 2019)

Data Breach at Equifax

by Suraj Srinivasan, Quinn Pitcher and Jonah S. Goldberg

Abstract

The case discusses the events leading up to the massive data breach at Equifax, one of the three U.S. credit reporting companies, the organizational and governance issues that contributed to the breach, and the consequences of the breach. The case supplement provides details of how Equifax recovered from the breach and changes the company made. On September 7, 2017, Equifax announced that the personal information of over 140 million consumers had been stolen from its network in a catastrophic data breach, including people’s Social Security numbers, driver's license numbers, email addresses, and credit card information. The announcement sparked a massive backlash, as consumers and public officials questioned how a company that managed sensitive personal information about over 800 million individuals could have such insufficient security measures. It came to light that Equifax had been aware of critical faults in its cybersecurity infrastructure, policies, and procedures for years but had failed to address them. Equifax’s public response also received criticism. CEO Richard Smith and numerous other executives resigned, and Equifax was left facing dozens of lawsuits, government investigations, and the potential for new regulation.

Keywords: cybersecurity; Safety; Information Management; Technology Industry; United States;

Language: English Format: Print 28 pages EducatorsPurchase

Citation:

Srinivasan, Suraj, Quinn Pitcher, and Jonah S. Goldberg. "Data Breach at Equifax." Harvard Business School Case 118-031, October 2017. (Revised April 2019.)

Related Work

  2. Case | HBS Case Collection | October 2017 (Revised April 2019)

    Data Breach at Equifax

    Suraj Srinivasan, Quinn Pitcher and Jonah S. Goldberg

    The case discusses the events leading up to the massive data breach at Equifax, one of the three U.S. credit reporting companies, the organizational and governance issues that contributed to the breach, and the consequences of the breach. The case supplement provides details of how Equifax recovered from the breach and changes the company made. On September 7, 2017, Equifax announced that the personal information of over 140 million consumers had been stolen from its network in a catastrophic data breach, including people’s Social Security numbers, driver's license numbers, email addresses, and credit card information. The announcement sparked a massive backlash, as consumers and public officials questioned how a company that managed sensitive personal information about over 800 million individuals could have such insufficient security measures. It came to light that Equifax had been aware of critical faults in its cybersecurity infrastructure, policies, and procedures for years but had failed to address them. Equifax’s public response also received criticism. CEO Richard Smith and numerous other executives resigned, and Equifax was left facing dozens of lawsuits, government investigations, and the potential for new regulation.

    Keywords: cybersecurity; Safety; Information Management; Technology Industry; United States;

    Citation:

    Srinivasan, Suraj, Quinn Pitcher, and Jonah S. Goldberg. "Data Breach at Equifax." Harvard Business School Case 118-031, October 2017. (Revised April 2019.)  View Details
    CiteView DetailsEducatorsPurchase Related

About the Author

Photo
Suraj Srinivasan
Philip J. Stomberg Professor of Business Administration
Accounting and Management

View Profile »
View Publications »

 
Campus Map
Campus Map
Harvard Business School
Soldiers Field
Boston, MA 02163
→ Map & Directions
Copyright © President & Fellows of Harvard College