Committee tells Equifax compensation meagre after breach

OTTAWA — The House of Commons’ ethics committee did not mince words with two Equifax Inc. (Canada) executives appearing before them Monday afternoon, imploring the company — at times in a fiery tone — to seriously consider better compensation and protections for Canadians after the hack made public in September. Part of the compensation for the hack — revealed last week to now have affected 19,000 Canadians — are complimentary credit monitoring and up to $50,000 in identity theft insurance for a year, which did not go over well with members of the standing committee on access to information, privacy and ethics. “I would suggest that the $50,000 is a little light on providing Canadians the reassurance that you’re going to take care of any breach,” committee chair Bob Zimmer said near the end of the session, in light of the approximately $250 million in revenue the Canadian division made last year. “You’re responsible for this data, and you’re responsible for taking care of this data.” That argument rested on two facts: that Equifax was at fault for not patching its vulnerable systems despite recommendation from the Department of Homeland Security (DHS), and the uncertainty about what the hackers will do with that information, which includes names, addresses, social insurance numbers and credit card information. John Russo, chief privacy officer and corporate secretary and his colleague, director of global operations Antonietta Di Napoli said they did not have information on what the compromised data was or is being used for. “As a breach I think you should be, at the very least, recovering all costs if not extras as a result of this particular data breach, which we all know...is your own fault and you’ve admitted to that; you apologized for that,” Zimmer said. Zimmer was joined by colleagues, who at times weren’t as reserved as Zimmer. For example, MP Brenda Shanahan made it clear that 12 months of free protection against possible identity theft that could happen at any time after that time period is unacceptable. In reference to having a restoration specialist to help customers recover from I.D. theft, which normally costs $20 per month, Shanahan said, “You should be paying for that if somebody is able to steal their I.D.” “It should be for life, Mr. Russo. For life,” Shanahan said. “Consumers have their SIN numbers and their birthdate for life, they are potentially at risk for life. I would leave that for you to think about.” Close to 2,000 Canadians of the 19,000 have subscribed to the one-year service, Russo said. He said a recent notice has gone out to the additional 11,000 affected Canadians notifying them about the compensation being offered. The 19,000 figure does not include Canadians living in the U.S., Russo confirmed. And despite not being able to provide more info on how many more Canadians outside the country could be affected, he said it would be a small number. Nevertheless, it is the first solid figure of Canadians impacted, as the number had yo-yoed from 100,000 to 8,000 since the breach went public. The hackers had access to Equifax’s systems from May 13 to July 30, the committee heard. The U.S. company, however, was warned by the DHS in March to upgrade the software, as a vulnerability in the systems put millions of Americans at risk. The company subsequently ran a test of its systems but did not find the same vulnerabilities and did not patch the system. “To the best of my knowledge, I wouldn’t be here today before you” had the system been patched, Russo said. Russo said 12 per cent of the company’s information technology budget was made to cybersecurity protection and for its systems. He admitted that the breach is a “watershed” moment and promised, in his opening remarks, that the company is making strides to ensure that such a hack never happens again. He added that some of those measures include a feature that would allow consumers to lock and unlock access to their credit file, which will be available next year for all Canadians, as well as alerts to notify the customers whenever someone touches the file and monitoring the dark web — a part of the internet that is not easily accessible — to ensure no data from the breach is being traded. “I would challenge you to do the right thing and make sure that Canadians are made whole again if affected by this,” Zimmer said to close the meeting. “Again, the concern is when this is going to affect Canadians — we’re not sure, but hopefully Equifax will step up to the plate.” — With reporting by Ahmad Hathout at ahathout@thewirereport.ca and editing by Bryson Masse at bmasse@thewirereport.ca

Committee tells Equifax compensation meagre after breach

News | December 5, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Committee tells Equifax compensation meagre after breach

News | December 5, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Watchdogs find deceptive privacy practices across majority of websites, apps studied

Privacy tribunal unlikely to get through INDU’s look at Bill C-27

Privacy tribunal needed in Digital Charter, ISED continues to tell MPs

Privacy commissioner flags excessive site blocking, privacy risks in age verification bill

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us