We're mostly on the same page, but here's my quibble: you hold Equifax responsible "for the damage they caused" but not for their role in corrupting the regulatory regime.

Regulators should answer to the people, but because corporations are extremely motivated, fabulously wealthy, and privileged by the court system, the people have to compete for the regulators' attentions. I think it makes sense to acknowledge that Equifax is acting against the common good, even if that's just incidental to Equifax acting in its own interests.