Yes, £500,000—that's the maximum fine allowed past times the UK's Data Protection Act 1998, though the penalisation is evidently a pocket-size figure for a $16 billion company.
In July this year, the UK's information protection watchdog issued the maximum allowed fine of £500,000 on Facebook over the Cambridge Analytica scandal, maxim the social media giant Facebook failed to preclude its citizens' information from falling into the incorrect hands.
Flashback: The Equifax Data Breach 2017
Equifax suffered a massive information breach terminal twelvemonth betwixt mid-May together with the goal of July, exposing highly sensitive information of equally many equally 145 1 grand one thousand people globally.
The stolen information included victims' names, dates of birth, telephone numbers, driver's license details, addresses, together with social safety numbers, along amongst credit menu information together with personally identifying information (PII) for hundreds of thousands of its consumers.
The information breach occurred because the fellowship failed to spell a critical Apache Struts two vulnerability (CVE-2017-5638) on time, for which patches were already issued past times the respected companies.
Why U.K. Has Fined a US Company?
The UK's Information Commissioner's Office (ICO), who launched a articulation investigation into the breach amongst the Financial Conduct Authority, has instantly cyber assault compromised Equifax systems inwards the United States, the fellowship "failed to guide hold appropriate steps" to protect the personal information of its fifteen 1 grand one thousand Great Britain customers.
The ICO investigation revealed "multiple failures" at the fellowship similar keeping users' personal information longer than necessary, which resulted in:
- 19,993 Great Britain customers had their names, dates of birth, weep upward numbers together with driving license numbers exposed.
- 637,430 Great Britain customers had their names, dates of nativity together with weep upward numbers exposed.
- Up to fifteen 1 grand one thousand Great Britain customers had names together with dates of nativity exposed.
- Some 27,000 Britishers also had their Equifax draw of piece of occupation organization human relationship electronic mail addresses swiped.
- 15,000 Great Britain customers also had their names, dates of birth, addresses, draw of piece of occupation organization human relationship usernames together with plaintext passwords, draw of piece of occupation organization human relationship recovery tube questions, together with answers, obscured credit menu numbers, together with spending amounts stolen past times hackers.
Breach Was Result of Multiple Failures at Equifax
The ICO said that Equifax had also been warned almost a critical Apache Struts two vulnerability inwards its systems past times the US Department of Homeland Security (DHS) inwards March 2017, simply the fellowship did non guide hold appropriate steps to make the issue.
Initially, it was also reported that the fellowship kept intelligence of the breach hidden for a month afterward its internal discovery, giving iii senior executives at Equifax fourth dimension to sell almost $2 1 grand one thousand worth of its shares, though the fellowship denied such claims.
Since the information breach happened earlier the EU's General Data Protection Regulation (GDPR) took outcome inwards May 2018, the maximum fine of £500,000 imposed nether the UK's former Data Protection Act 1998 is even together with then lesser.
The penalisation could guide hold been much larger had it fallen nether GDPR, wherein a fellowship could confront a maximum fine of twenty 1 grand one thousand euros or iv per centum of its annual global revenue, whichever is higher, for such a privacy breach.
In response to the ICO’s penalty, Equifax said that the fellowship has fully cooperated amongst the ICO throughout the investigation that it is "disappointed inwards the findings together with the penalty."
Equifax received the Monetary Penalty Notice from the ICO on Midweek together with tin forcefulness out appeal the penalty.
