Equifax Provides Canadians with Additional Clarity on Cybersecurity Incident Involving Consumer Information

TORONTO, ONTARIO--(Marketwired - Sept. 19, 2017) - Equifax Canada is providing additional information to Canadians that may be among certain consumers impacted by a cybersecurity incident announced last week by Equifax Inc. On September 7, 2017, the company announced that criminals exploited a U.S. website application vulnerability to gain access to certain files. Based on the company's investigation, the unauthorized access occurred from mid-May through July 2017. Although it was originally thought that the incident was limited to U.S. consumers, Equifax discovered shortly before the September 7 announcement that some Canadian and U.K consumers were also impacted.

While our investigation is ongoing and this information may change, at this point, we believe that the incident involves potential access to the personal information of approximately 100,000 Canadian consumers, and that the information that may have been breached includes name, address, Social Insurance Number and, in limited cases, credit card numbers.

Equifax Inc. discovered the unauthorized access on July 29 of this year and acted immediately to stop the intrusion. The company promptly engaged a leading, independent cybersecurity firm to conduct a comprehensive forensic review to determine the scope of the intrusion, including the specific data impacted. Equifax also reported the criminal access to law enforcement and continues to work with authorities.

Equifax Canada is working in close coordination with Equifax Inc. and the independent cybersecurity firm in conducting the ongoing investigation. The criminal actors accessed Equifax Inc.'s systems through a consumer website application intended for use by U.S. consumers. Through this interface, the criminal actors obtained access to files containing personal information of certain Canadian consumers.

"We apologize to Canadian consumers who have been impacted by this incident," said Lisa Nelson, President and General Manager, Equifax Canada. "We understand it has also been frustrating that Equifax Canada has been unable to provide clarity on who was impacted until the investigation is complete. Our focus now is on providing impacted consumers with the support they need."

Equifax has been working with the Office of the Privacy Commissioner of Canada (OPC) and will be sending notices via mail directly to all impacted consumers outlining the steps they should take. For impacted Canadians we will also be providing complimentary credit monitoring and identity theft protection for 12 months.

Although only a limited number of Canadians have been impacted, Equifax reminds Canadian consumers to be vigilant in reviewing their account statements and credit reports and that they immediately report any unauthorized activity to the financial institutions. We also recommend that they monitor their personal information.

Equifax is updating its website to provide information designated for Canadian consumers to understand the incident and the company's response.