Data breaches have significant real-world harm. Unfortunately Equifax got out of this without paying fines in several state at least. It was the regulators who failed us here, not the market: https://www.reuters.com/article/us-equifax-states-agreement/...
Customer data should be like radioactive waste. Companies should know that if they have it, they have to take appropriate measures to secure it, and if they don't they will take a significant financial hit. The financial penalties should be significant enough that if a business doesn't feel sure they can invest into proper security, it makes more sense to just not keep the user data.
On the contrary: the credit reporting industry is a perfect example of market failure thanks to regulatory capture.
The actors in the market exercise a high degree of control over the regulators. The regulators are not independent and the companies that influence them are not innocent.
All markets are constructed. The credit reporting market is just set up with rules which are grossly harmful to individuals.
Regulators should answer to the people, but because corporations are extremely motivated, fabulously wealthy, and privileged by the court system, the people have to compete for the regulators' attentions. I think it makes sense to acknowledge that Equifax is acting against the common good, even if that's just incidental to Equifax acting in its own interests.
There are no significant regulatory penalties coming at Equifax over this (the biggest change is that credit freezes are now free, which is great win but won't have a huge market impact).
Additionally, consumers can't choose not to participate in this process. I mean, if you're wealthy, you can choose not to buy anything on credit, and if you're tech savvy you can choose to freeze your credit with Equifax and force the majority of your traffic through other companies. But again, that's not the majority of the population and it's not going to have much of an effect.
Businesses aren't going to stop relying on social security numbers and background checks, because... well, for a lot of reasons, but partially because that system is really entrenched and it would take more than leaking half of the US population's data to make it change. That's going to be a very, very hard battle to win. In the meantime, that just means its even harder for consumers to avoid businesses that rely on Equifax for credit checks.
So, the market determined that consumers were not going to change their behaviors over this breach, in part because there aren't a lot of reasonable ways for consumers to do anything. It determined that Equifax wasn't likely to be harmed in the long term by the government, and it determined businesses weren't going to change their behavior around identity verification -- and it priced itself accordingly.
If you want the market to punish bad actors, you have to give consumers and people effected by the market agency to move their business or to choose not to participate in systems they don't like. Current credit systems just don't give ordinary consumers that kind of agency.
This also pops up in privacy debates sometimes where people say, "oh, people don't care." That's sometimes true, but it's generally really complicated -- and part of the reason it's complicated is because consumers have been taught over and over that there is no point to caring and nothing they do is going to stop companies from tracking them.
But not a cost or negative consequence to the organization that the data came from
Markets with true competition can only be sustained through continuing struggle, because companies hate competition and constantly innovate new ways to capture the regulators.
The best we can do is regulators who retain their humility and exercise a light touch.
Realistically, apart from the obvious "this shouldn't have happened in the first place", what more could they be doing?
There isn't many options out there, so they basically have the monopoly on identity protection.
They can offer a couple years of their BS identity protection, but your identity is ruined forever. Your SSN doesn't rotate or expire. There should be no time limit on any remedy they provide.
Do people actually lose large amounts of money due to ID theft? I've always considered ID theft to be the lenders being defrauded, and while it is a huge hassle to get sorted, the real person isn't legally liable for the debt fraudulently obtained in his name.
Also, if you think money is a bad idea, what else do you propose? I'd rather take money with the chance of losing it rather than no money and "credit monitoring" which doesn't actually prevent ID theft, only alerts you after it's already too late.
If anything, the money idea actually makes sense as insurance for future losses due to potential ID theft.
Surely it's typical for credit unions to have deposit insurance? If not, there should be regulations in place to ensure people understand that they are basically just shareholders.
I know for a fact that almost every large institution of even the slightest quality is currently in full panic mode regarding their cyber posture. Look at JPMC, spending nearly 1 billion dollars a year on cyber. I know most of the other big financials are right there as well in terms of % of revenue.
In the financial industry alone, there's a huge uptick in regulatory responsibility globally for asset, vulnerability, and threat management. The SWIFT (messaging system that all major banks communicate and send money on) auditors and regulators are requiring almost all of these issues be "solved" for or having a meaningful workflow within your respective organization. Guess what happens if you don't meet it? You have a serious finding against your institution and you will struggle to do business with any of the other more mature cyber organizations that rely on SWIFT. Worse yet, when large customers request the output of these audits and findings -- if you do not comply, they will move their money. I know several of the largest financials lost massive clients and revenue due to not complying with the cyber standards set forth by SWIFT.
I know for a fact within the US the OCC (governing body for financial institutions regarding cyber) is coming down very hard on the cyber posture of a lot of the banks and is making them move faster, otherwise they face a long uphill battle to expand or make significant changes within the US.
Unfortunately I don't think new laws would help anything, as evidenced in the past.
But they discourage similar behavior in the future, no?
How about prosecuting the people exfiltrating the data? Seems like they should be 100% liable for their actions.
I certainly want companies like Equifax held accountable when they break the law, but lamenting that shareholders haven’t lost money is to fundamentally misunderstand the financial system. The solution is to slowly ratchet up the unprofitably of Equifax when they do wrong so that it makes the sector less attractive over time. Simply crushing the company with a multi-billion fine would collapse the stock all at once, destroying significant percentages of pension funds which hurts the very people for whom you ostensibly feel sympathy.
In short, naïve, knee-jerk reactions are dangerous for markets and can cause widespread harm. The right answer is to tighten regulations around this industry so that risk gets priced into the stock which makes it less profitable over time which gives institutional investors time to reallocate with minimal shock to those who can least afford such shocks.
The poor person is denied a car loan. It was already the cheapest car they could find, and they don't have the money to fix the old car. They can't take time off work to go to the bank to fight the fraud, but it doesn't matter because they've already been fired due to not having a way to get to work anymore. Before they can find a new job, they're evicted from their apartment for missing rent.
Tell me again how rich people are more affected by identity theft.
you're basically claiming that every company purchased by any pension (so, basically, every company) is Too Big To Fail. if taking down one medium-sized company has any noticeable effect on public pensions, then the public pensions need serious reform.
> Stealing the identity of people with few assets is a lot less profitable than stealing the identity of rich people.
to echo what the sibling comment said, this is a major problem with the continued misappropriation of the word "theft" to refer to things which cannot be physically taken (cf. intellectual property "theft"). sure, if you could literally take over the identity of a rich person, that would be worth much more than the identity of a poor person. but that's not how "identity theft" works. "identity theft" means, largely, opening accounts in someone else's name. rich people are far more likely to notice, and far more able to take action. even if I had Bill Gates's full name, date of birth, address, social security number, all financial account information (hell, half of these are public information already anyways)... I'm not going to be able to open an account in his name, and even if I was, I would almost certainly be caught immediately and sent to jail.
> The right answer is to tighten regulations around this industry so that risk gets priced into the stock which makes it less profitable over time which gives institutional investors time to reallocate with minimal shock to those who can least afford such shocks.
Here's how much Equifax has spent on lobbying the last 10 years:
2008 - 500K
2009 - 500K
2010 - 560K
2011 - 670K
2012 - 620K
2013 - 690K
2014 - 770K
Interesting what happens next considering this headline: A.Equifax Learned of Significant Cybersecurity Deficiencies in 2015
2015 - 1.02K
2016 - 1.1K
2017 - 1.07K
2018 - 1.27M
Here's the status of three bills that were introduced:
S.1815 - Data Broker Accountability and Transparency Act of 2017 Introduced 09/14/2017 https://www.congress.gov/bill/115th-congress/senate-bill/181...
H.R.3806 - Personal Data Notification and Protection Act of 2017 Introduced 09/18/2017 https://www.congress.gov/bill/115th-congress/house-bill/3806...
S.1816 - Freedom from Equifax Exploitation Act Introduced 09/14/2017 https://www.congress.gov/bill/115th-congress/senate-bill/181...
As much as I appreciate the idealistic approach to regulate the markets but it clearly doesn't work. Period. It only takes a company or industry with a lot of money to essentially write their own laws.
Yet Equifax is doing better than ever. No new laws, no reform, nobody goes to jail. All the rich people get to keep their money.
Thoughts and prayers.