Does the US government have any plan to punish Equifax for failure to stop Chinese breach?

Question

I read about how Equifax was hacked by Chinese hackers and stole the data of over 146 million Americans, a hack that was partially only possible because Equifax made simple security mistakes like setting "admin" as the username and password for several accounts. Does the United States government have any plan to punish Equifax for their negligence or make them increase their cyber-security?

Answer 1

Yes. The FTC ruled that Equifax has to pay a settlement to its customers, the federal government and state governments for the breach. By the FTC ruling this, it means that Equifax can't fight the customer claimants in court on the merits of the case, but it also means that the government, itself, won't be collecting a fine or any pelts for a penitentiary wall.

Equifax also has to take specific measures to insure security going forward and has to have that certified by a third party.

The Federal Trade Commission said in a statement Monday that Equifax has agreed to initially pay at least $575 million in fines as part of the settlement with the federal government and states over its “failure to take reasonable steps to secure its network” that led to the breach.

....As part of the settlement, Equifax will also have to improve its data security going forward, said Joe Simons, FTC chairman, including designating staff to oversee its information security program.

Equifax will also have to undergo third-party assessments every two years.

FTC Slaps Equifax with a fine of up to $700M ofr 2017 data breach

While it was or is the largest fine by the FTC, many still consider it to be relatively mild, in terms of impact to the company.