We don't know how the security breach happened. Should Equifax be criminally liable for using software which contains a remote-exploitable buffer overflow vulnerability? Or for the actions of a corrupt employee who stole some data and sold it on the black market?

It's possible that Equifax did something really negligent and if so maybe there should be a class-action lawsuit against the company. But it's also possible they did all the things they should have done and still failed because security is really hard and maybe the attacker got lucky.

Isn't the traditional capitalistic argument that the people on top are the ones taking all the risk, which is why they should be making all of that money in the first place?

Note that I'm not making that argument, but trying to understand how this situation differs.

You take a lot of the risk but not all. If this was due to weaknesses in their IT then managers should be liable. But it's possible that they had one of the most secure systems in finance and still someone found a way in via undisclosed exploits. In that case there's nothing a manager could've done.

But since the core database wasn't hacked, it seems likely that someone had a database dump on a development machine which was outside the scope..

I don't think it's fair to be throwing any individuals under the bus like that. There's obviously been several failures at multiple levels but the company as a whole will have to face the consequences, not just a few managers it decides to use as scapegoats.

Well, except for this:

"Three Equifax Inc. senior executives sold shares worth almost $1.8 million in the days after the company discovered a security breach that may have compromised information on about 143 million U.S. consumers."

https://www.bloomberg.com/news/articles/2017-09-07/three-equ...

Hah, that's actually excellent news for those hoping for criminal consequences. It might be hard to put anybody in jail for their security negligence, but to me it looks like those three have served themselves up on a platter for an insider trading conviction.

> I don't think it's fair to be throwing any individuals under the bus like that. There's obviously been several failures at multiple levels but the company as a whole will have to face the consequences, not just a few managers it decides to use as scapegoats.

Why not?

How about a lot of managers, then?