Equifax Credit Reporting

The subject of the file is not the buyer of the file

Consumer reporting agencies collect information from lenders and other furnishers, match it to individuals, and sell reports or related products to businesses making decisions. The reports can reduce the cost of evaluating credit and support transactions at enormous scale. Yet the person described usually did not select Equifax, negotiate the data collected, or decide which customer would use it.

That three-sided structure changes accountability. The paying customer wants a fast, predictive file. The furnisher wants efficient reporting. The consumer needs accuracy, security, context, and correction even when those protections slow the other two parties. The Fair Credit Reporting Act supplies public duties because ordinary customer choice cannot protect the file's subject.¹

The 2017 breach exposed the cost of accumulated legibility

Attackers accessed Equifax systems in 2017 and obtained names, Social Security numbers, dates of birth, addresses, and other data concerning roughly 147 million people. GAO found that Equifax failed to properly implement a patch for a known vulnerability and identified problems in detection, segmentation, and data governance that allowed the intrusion and delayed discovery. The report also describes remediation; it does not establish that no security control worked or that one employee caused the breach.²

Scale created value and hazard together. Matching many sources made Equifax useful to customers. The same concentration let one compromised system expose identity attributes people cannot readily replace. A password can be changed; a birth date or Social Security number remains attached to the person long after the company closes an incident.

The 2019 settlement with the Federal Trade Commission, Consumer Financial Protection Bureau, and states required payments and consumer assistance that could reach at least $575 million and potentially more. Settlement created remedy after exposure, but money and monitoring cannot restore secrecy to a permanent identifier.³

Accuracy is a process, not a property of the database

Credit reporting errors arise from identity matching, furnisher data, mixed files, fraud, timing, and the interpretation of a dispute. GAO found that no comprehensive source could precisely measure the frequency and effects of all errors, while complaints and studies showed that inaccuracies could be consequential. Accuracy therefore cannot mean that a record came through the expected pipeline. It requires a review capable of considering evidence that the pipeline is wrong.⁴

In a 2025 consent order, the CFPB found that Equifax failed from 2015 through 2022 to conduct reasonable reinvestigations in specified dispute processes, including failures involving consumer documents, identity-theft blocks, and reinserted information. Equifax neither admitted nor denied the findings but consented to the order and a $15 million penalty. The legal posture matters: the order establishes enforceable findings and obligations, not an adjudicated admission by the company.⁵

Automation can make the problem look resolved while reproducing it. If a bureau routes a consumer's dispute back to the furnisher as a short code and receives verification, the workflow has completed. But completion is not correction when documents or identity context never govern the result. A closed ticket can be evidence of throughput and evidence of organizational ignorance at the same time.

Portability requires an appeal outside the production loop

Autonomy with evidence is unusually concrete here. A consumer needs access to the relevant file, notice of adverse use, the ability to attach evidence, a human review when matching or fraud is disputed, and a record of what changed. The decision-maker also needs provenance: which furnisher supplied a fact, when, under which identity match, and after what review.

These rights cannot depend on becoming Equifax's best customer. They are constitutional constraints on an information utility whose commercial success comes from describing people to others. Security must likewise treat the subject as the beneficiary: minimize retained data, segment access, patch promptly, detect abnormal use, and assume permanent identifiers cannot be repaired after disclosure.

Equifax is not a claim that credit information has no legitimate use. It is a test of whether a private evidence system can remain answerable to someone who cannot exit it. The system earns legitimacy only when the person represented by the file can see, challenge, and survive the record more effectively than a customer can silently consume it.