Equifax/Social Security Tie-Up Raises Concerns

Summary

---

WSJ Your Money Briefing: Equifax/Social Security Tie-Up Raises Concerns

Date: September 20, 2017
Host: J.R. Whalen
Guest: Michael Rapoport (Wall Street Journal Reporter)

---

Episode Overview

This episode delves into growing concerns surrounding Equifax’s partnership with the U.S. Social Security Administration (SSA) and the Centers for Medicare & Medicaid Services (CMS) in the wake of the recent Equifax data breach. WSJ reporter Michael Rapoport explains the nature of these relationships, the implications of the breach, and the ongoing investigations.

---

Key Discussion Points & Insights

1. Equifax’s Government Contracts and Their Scope

• Identity Verification:
  Equifax provides vital identity verification services for the SSA, specifically the "My Social Security" portal which allows users to:

  • Check Social Security benefits
  • Request replacement Social Security ID cards
    (Michael Rapoport, 01:05)

• Employment and Income Data:
  For CMS, Equifax supplies employment and income data to help verify consumer eligibility for subsidies under the Affordable Care Act.
  (Michael Rapoport, 01:05)

2. Financial Stakes and Timeline

• Lucrative but Modest Contracts:
  These two government contracts bring Equifax approximately $20 million annually—modest compared to their total $3 billion in annual revenue, yet still a notable ongoing income stream.
  (Michael Rapoport, 01:38)

• Contract History:

  • SSA contract: Several years running
  • CMS contract: Since about 2013
    (Michael Rapoport, 01:56)

3. Implications of the Data Breach

• No Evidence of Direct Impact on SSA/CMS:
  There is no evidence so far that SSA or CMS systems were directly compromised by the Equifax breach.
  (Michael Rapoport, 02:13)

• Nature of Compromised Data:
  The breach at Equifax led to the theft of personal information such as names, addresses, drivers’ license numbers, and Social Security numbers—though specifically through Equifax systems, not the SSA portal.
  (Michael Rapoport, 03:36)

• Notable Quote:

  “Anyone accessing the Social Security Administration's portal, that information, to the best of our knowledge, was not compromised.”
  — Michael Rapoport, 03:36

4. Ongoing Business Activities Amid Crisis

• Business as Usual:
  Despite the breach, Equifax continued its operations, including announcing a new deal with Fidelity National for a fingerprint-based verification service while the investigation was ongoing.
  (Michael Rapoport, 02:27)

• Expansion Beyond Credit Reporting:
  Equifax has proactively expanded its product offerings beyond traditional credit reporting to new identity and verification services.

• Notable Quote:

  “They’ve been very active in introducing new products and expanding their business outside of their traditional credit reporting services.”
  — Michael Rapoport, 02:54

5. Investigations and Regulatory Response

• Ongoing Federal and State Probes:
  • The FBI is leading a criminal investigation.
  • Regulatory bodies such as the Federal Trade Commission and the Consumer Financial Protection Bureau are also investigating.
  • Multiple state regulators have weighed in.
  • The investigations are expected to continue for some time. (Michael Rapoport, 04:03)

---

Notable Quotes

• On breach impact:

  “There’s no evidence that Social Security Administration or the CMS systems were compromised due to the Equifax breach.”
  — Michael Rapoport, 02:13

• On continued business activity:

  “What they’ve been doing ever since… is they've continued on kind of a business as usual track, investigating the data breach, not telling any consumers anything about it until early September.”
  — Michael Rapoport, 02:27

---

Important Timestamps

• 01:05 — Michael Rapoport describes Equifax’s role with SSA and CMS.
• 01:38 — Discussion of the financial significance of these contracts.
• 02:13 — Clarification that no SSA or CMS data was compromised.
• 02:27 — Equifax’s continued product rollouts amid the investigation.
• 03:36 — Details on the nature of stolen data and reiteration of SSA portal’s presumed safety.
• 04:03 — Outline of ongoing multi-agency investigations.

---

Tone and Style

The conversation maintains an objective and factual tone in line with WSJ reporting, focusing on clarity and the real-world implications of financial and data-security issues.

---

Transcript

[Charles Schwab Announcer]

This episode is brought to you by Charles Schwab. Decisions made in Washington can affect your portfolio every day, but what policy changes should investors be watching? Washington Wise is an original podcast from Charles Schwab that unpacks the stories making news in Washington right now and how they may affect your finances and portfolio. [e-mail] WashingtonWise.

[J.R. Whalen]

This is yous Money Matters from the Wall Street Journal. Welcome to youo Money Matters. I'm JR Whalen in New York. The recent data breach of Equifax Networks has raised new concern over the company's work with the U.S. social Security Administration and the company's supply of identity verification services to the agency. Wall Street Journal reporter Michael Rapoport joins us in our studio with details. So Michael, can you explain specifically the nature of the work that Equifax does for Social Security and the Centers for Medicare and Medicaid Services?

[Michael Rapoport]

Equifax supplies identity verification services to the Social Security Administration, what's called the My Social Security portal. That's a portal that consumers use to do things like check their Social Security benefits and request replacement Social Security ID cards for the center for Medicare and Medic Medicaid services. What they do is supply employment and income data that the CMS uses to check consumers eligibility for subsidies to purchase health insurance under the Affordable Care Act.

[J.R. Whalen]

And this is a lucrative project for Equifax, is that right?

[Michael Rapoport]

Well, together those two contracts supply Equifax about roughly $20 million in revenue a year. Equifax has more than $3 billion in revenue yearly, so it's not a huge amount. It is a continuing source of income for the company.

[J.R. Whalen]

And they've been doing this with the government agencies for a while for the

[Michael Rapoport]

last few years for Social Security, for the last year or two for CMS, since about 2013.

[J.R. Whalen]

Now, you point out in your story in the Wall Street Journal there's no evidence that Social Security Administration or the CMS systems were compromised due to the Equifax breach. Is that right?

[Michael Rapoport]

That's right.

[J.R. Whalen]

As the investigation was going on into the most recent Equifax breach, you talk about in your story, the fact that they were developing a additional verification services to sell to companies. Is that a fair way to say it?

[Michael Rapoport]

What they've been doing ever since continuing doing ever since they discovered the breach in late July is they've continued on kind of a business as usual track investigating the data breach, not telling any consumers anything about it until early September. But in that time, for instance, they announced a new deal with a company called Fidelity national to provide a new verification service that would allow consumers to access a variety of accounts through one single identifier that will be accessed through a fingerprint. So they've continued along their same track over the last several years. They've been very active in introducing new products and expanding their business outside of their traditional credit reporting services.

[J.R. Whalen]

All right, we're speaking with the Wall Street Journal's Michael Rappaport about Equifax's work with the US Government providing identity verification information. And you're listening to your Money Matters from the Wall Street Journal. Thanks for listening, everyone. So, Michael, Social Security Administration says they never share Social Security numbers with Equifax, but Social Security numbers may have been among the data at risk during the Equifax hack.

[Michael Rapoport]

Well, Social Security numbers were at risk, but through Equifax, the information compromised that was stolen from Equifax included stuff like names, addresses, driver's license numbers, Social Security numbers, but that all happened through Equifax. Anyone accessing this Social Security Security Administration's portal, that information, to the best of our knowledge, was not compromised.

[J.R. Whalen]

Okay. And the investigations go on into the hack that was divulged just last week.

[Michael Rapoport]

The FBI is investigating. The Federal Trade Commission and the Consumer Finance Protection Bureau, which regulate Equifax, are also investigating. Various state regulators have weighed in as well. There are a number of investigations that are going to go on a while.

[J.R. Whalen]

All right, that's the Wall Street Journal's Michael Rapoport joining us here in the studio. Michael, thanks for being with us.

[Michael Rapoport]

Thank you.

[J.R. Whalen]

And thank you for listening to your Money Matters. I'm J.R. whalen at the Wall Street Journal.

[Charles Schwab Announcer]

This episode is brought to you by Charles Schwab. Decisions made in Washington can affect your portfolio every day. Washington Wise from Charles Schwab is an original podcast that unpacks the stories making news in Washington. [e-mail] WashingtonWise.