The now-infamous Equifax data breach was even worse than initially feared, say a team of Senate Democrats who are pressing the Consumer Financial Protection Bureau to launch a “robust investigation.”
United States Senators Elizabeth Warren (D-Mass.), Robert Menendez (D-N.J.), and Brian Schatz (D-Hawaii) recently unveiled what they say is the first comprehensive review of consumer complaints in the wake of the 2017 Equifax breach.
Their report found that in the six months following the breach, the CFPB received more than 20,000 complaints from consumers about the impact of the breach, problems with Equifax's response, or other issues with the company. The number of complaints nearly doubled after the breach.
The senators sent their report to Acting CFPB Director Leandra English and Office of Management and Budget Director Mick Mulvaney and pressed them to hold Equifax accountable and protect consumers from future data security breaches. The senators also asked that Mulvaney abandon his plans, revealed last week to a room full of bankers, to hide certain CFPB consumer complaint data from the public.
Late last year, Equifax, reported a data breach that may have affected upwards of 143 million U.S. consumers. The breach lasted from mid-May through July, when hackers penetrated a Web-based application and accessed names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers. Approximately 209,000 individuals had their credit card numbers stolen.
Continuing investigations now identify upwards of 2.4 million U.S. consumers whose partial driver’s license information was stolen, but who were not in the previously identified affected population. Months after the Equifax breach, consumers are still facing a myriad of problems and continue to seek assistance from the CFPB, the senators say.
Despite the severe threat to consumers and the CFPB's responsibility to protect them, the investigation into Equifax has reportedly “sputtered” since Mulvaney took over the CFPB, they allege. While the CFPB has confirmed that an inquiry is still open, reports indicate that the agency has not sought subpoenas or testimony from Equifax executives.
Reports also suggest that the CFPB “rebuffed” other bank regulators’ offers to help with the investigation despite former CFPB Director Rob Cordray making it clear that this cooperation was necessary and welcome.
In a letter to Mulvaney accompanying the report, the senators raised concerns about reports that Mulvaney had indicated at an American Bankers Association summit that he would soon order certain parts of the CFPB complaints database be kept secret and unavailable to the public. The senators wrote that, without this information, researchers and advocates would lose the ability to track in real time the difficulties consumers are facing and companies would have a harder time conducting due diligence on potential partners to make sure they don't cheat their customers.
“Other federal and state regulators may lose access to this important information, making it more difficult for them to identify systemic fraud,” they wrote. “Most importantly, removing this information would take away crucial information consumers need in order to make informed decisions about who to trust, information that is even more important in an era when the consumer watchdog is controlled by Mulvaney, who has acted quickly to limit CFPB actions to protect consumers.”
The letter adds: “Hiding this information from the public would directly harm consumers and allow financial institutions to shield even widespread scams from public view. We urge to you immediately reconsider any plans you have to hide important information in the consumer complaint database from the public.”
“[Our] report confirms our worst fears, that the breadth and depth of the Equifax breach has had and continues to have a devastating impact on the financial well-being of millions of Americans,” Menendez said. “That’s why we need strong legislation that holds consumer reporting agencies accountable for data breaches and requires them to offer free credit freezes and free assistance to affected consumers. In addition, we must continue to fight efforts by this Administration to defang our consumer financial watchdog. American consumers need a CFPB that will look out for them and hold big corporations like Equifax to account.”
The SECURE Act introduced by Senators Warren and Schatz in September 2017 would make it easier for consumers to dispute and correct errors in their credit reports. The report found more than 7,000 consumers filed complaints over incorrect information on their Equifax reports. Senators Warren, Schatz, and Menendez also introduced the FREE Act, which would allow consumers to freeze their credit reports for free and prohibit credit bureaus from selling data to third parties when a credit freeze is in effect.
Senator Menendez's Consumer Data Protection Act would hold credit reporting agencies accountable for data breaches and incentivize better data security practices while at the same time providing impacted consumers with tools to protect themselves.
The Data Breach Prevention and Compensation Act of 2018, introduced by Senators Warren and Warner in January, would require the FTC to promulgate cyber-security standards for credit reporting agencies and would impose strict penalties on companies that fail to adequately protect consumer data.