It’s not as black and white as it seems: the CIO was not directly told that Equifax itself had suffered a breach, simply that one of their clients had been.

[1] https://www.bloomberg.com/view/articles/2018-03-15/is-inside...

[2] page 6 of https://www.sec.gov/litigation/complaints/2018/comp-pr2018-4...