Equifax CEO Richard Smith leaves suddenly, retirement package in limbo

NEW YORK — Equifax CEO Richard Smith retired Tuesday, as the credit reporting agency tries to recover from a damaging data breach that exposed highly sensitive information about millions of consumers in the United States, United Kingdom and Canada.

Smith’s sudden departure comes less than three weeks after Equifax revealed that a security breach had exposed sensitive information about 143 million in the United States.

It later said about 100,000 Canadian consumers may have had their personal information compromised in the massive cyberattack, in addition to 400,000 in the United Kingdom.

Equifax said hackers exploited a software flaw that the company didn’t fix to heist Social Security or Social Insurance numbers, birthdates and other personal data that provide the keys to identify theft.

Although many analysts had applauded Equifax’s performance under Smith, he and the rest of his management team had come under fire for lax security and its response to the breach.

Court proceedings

'The impact of this trauma will echo for generations': court case surrounding La Ronge woman's death reaches conclusion

9h ago

Going Global

P.A.'s Zablocki named to Team Canada for U18 Women's World Championships

9h ago

Election 2024

Birch Hills staff won't share election decision

10h ago

Equifax’s chief security officer and chief information officer also abruptly retired on Sept. 17.

Smith, who had been Equifax’s CEO since 2005, will also step down from the chairman post. Paulino do Rego Barros Jr., most recently president of the Asia Pacific region, was named interim CEO, while board member Mark Feidler was appointed non-executive chairman. Equifax said it will look both inside and outside the company for a permanent CEO.

Equifax said Smith was retiring, but will not receive his annual bonus and other potential retirement-related benefits until the company’s board concludes an independent review of the data breach. If the review does not find Smith at fault, he could walk away with a retirement package of at least $18.48 million, along the value of the stock and options he was paid out over his 12-year tenure.

Even with the departures of three top executives, Equifax is still facing several inquiries and class-action lawsuits, including Congressional investigations, queries by the Federal Trade Commission and the Consumer Financial Protection Bureau, as well as several state attorneys general. Three executives, none of them among those who have left, were found to have sold stock for a combined $1.8 million before Equifax disclosed the most serious breach, though the company says they were unaware of it at the time.

Although analysts had previously applauded Equifax’s performance under Smith, he and the rest of his management team had come under fire for lax security and its response to the breach. Confusion over the terms of credit-monitoring protection and jammed phone lines added to people’s ire. Its stock has lost a third of its value — a $5.5 billion setback.

Lawmakers are considering sweeping reforms on Equifax and its two main rivals, Experian and TransUnion.

Smith had been scheduled to appear at two Congressional hearings next week that would likely have turned into a public lambasting. The House Energy and Commerce committee said in a tweet that it still plans to hold its hearing Oct. 3. A member of the Senate Banking Committee said he still wanted Smith to appear on Oct. 4 as planned.

“A CEO walking out the door just days before he is to appear before Congress is an abdication of his responsibility. This company has jeopardized the financial health and security of 143 million people, and they need to be held responsible. So I fully expect Mr. Smith to testify before the Banking Committee next week, regardless of the timing of his retirement,” said Sen. Brian Schatz, D-Hawaii.

The data breach might not have happened if Equifax had responded promptly to a March warning about a known security weakness in a piece of open-source software called Apache Struts. Even though a repair was released, Equifax didn’t immediately install it. Digital burglars used the crack in Equifax’s computer systems to break in from May 13 through July 30, according to the company’s accounting.

Equifax said it didn’t fathom the breadth of information that had been stolen until shortly before issuing a public alert on Sept. 7, triggering the wave of withering condemnations that has led to Smith’s departure.

The jobs of other Equifax executives could still be in jeopardy. The three who sold shares, including Equifax’s chief financial officer, are under scrutiny.

Smith’s departure also won’t make life any easier for most of the U.S. adult population who had their information accessed and now must worry about impostors assuming their identities to obtain credit cards and apply for loans.

Equifax Inc. is providing a year of free protection against identify theft for anyone who wants it, but some lawmakers are trying to pressure the company into extending that offer for the next decade. Some experts say that still isn’t enough to guard against identify theft and are advising consumers to put a freeze on their files at Equifax, Experian and TransUnion to prevent anyone from getting a loan under their names.

A credit freeze though creates its own headaches since it also prevents the person making it from getting a new credit card, mortgage, auto loan or even an expensive smartphone paid through monthly installments. It also costs money to do at Experian and TransUnion in most states. Equifax is temporarily waiving its normal fee for credit freeze as another part of its effort make amends for its security breakdown.

The Associated Press