Equifax suffered another major breach before the massive data breach disclosed earlier this month, the company confirmed Monday, revealing the 118-year-old credit-reporting agency suffered two major incidents in the span of a few months adds to a mounting crisis at the company.
The earlier breach was discovered by Equifax in March. But the company said that the earlier intrusion was unrelated to the breach that may have affected as many as 143 million people, which the company discovered in July but did not disclose until six weeks later.
“Equifax complied fully with all consumer notification requirements related to the March incident,” Equifax said in a statement. “The two events are not related.”
The company said it discovered the incident on July 29 and “acted immediately to stop the intrusion and conduct a forensic review.” Equifax hired the security firm Mandiant on both occasions and may have believed it had the initial breach under control, only to have to bring the investigators back when it detected suspicious activity again on July 29, two of the people said.
The disclosure of a second major breach is likely to spark intensified scrutiny from consumers and lawmakers, who have already expressed frustration over the company’s security lapses and its handling of events after the July breach was made public.
Equifax has said the executives “had no knowledge that an intrusion had occurred at the time,” when the transactions were made and the company spokesperson declined to make them available for comment. The company’s shares fell as much as 1.3 percent in after-hours trading. The stock closed at $94.38 in New York on Monday.
At least two congressional hearings are slated for the coming weeks. And Equifax faces multiple federal investigations on the breach as well as over reports that executives sold an unusual amount stock before the July hack was disclosed. Last week, two officials responsible for Equifax’s security and information technology abruptly retired.
The company spokesperson said Equifax is “working diligently with our bank partners to assess and mitigate any impact to their operations.”
