The report doesn't appear to mention that you could just login to their web portal with an obvious password [1]. It also doesn't appear to be under the purview to look at the leadership team selling stock[2]. Both of which it should consider when reviewing the competency and ethics of an organization managing and profiling nearly everyone in the U.S.

Speaking of which... why is it only ~50% of the adult population in the U.S.?

If the intruders were going around the Equifax network at will (which from the report it appears they were). We should assume 100% of the data was breached.

[1] https://www.cnbc.com/2017/09/14/equifax-used-admin-for-the-l...

[2] https://www.bloomberg.com/news/articles/2018-03-14/sec-says-...