1 of 8

Analysis of the 2017 Equifax Data Breach

Mitchell Melrose

2 of 8

The Crisis Begins

  • Data breach discovered in summer of 2017
  • Over 100 million Americans were affected
  • Info leaked included credit cards, addresses, and social security numbers
  • Caused by a front-end website exploit
  • Attackers suspected to be employed by Chinese Government

3 of 8

Situational Crisis Communication Theory

Crisis Cluster

Crisis Types

Stakeholder Attribution

Victim

  • Natural Disasters
  • Rumors
  • Outside tampering/malevolence

Minimal responsibility placed on organization

Accident

  • Technical/Equipment Failures

Mild to moderate responsibility place on organization

Preventable

  • Human-error accidents
  • Organizational misconduct/misdeeds

Strong, if not entire responsibility placed on organization

4 of 8

Situational Crisis Communication Theory

Response Type

Responses

Denial

  • Attack accusers
  • Deny existence of crisis
  • Deflect blame to others

Diminishment

  • Excuses - Claim inability to control events
  • Justification for actions taken

Rebuilding

  • Compensation
  • Apology

5 of 8

Equifax’s Crisis Response

  • Initial announcement on September 7, 2017
  • Daily updates given in the weeks following
    • Offered free credit and identity monitoring
  • Silence for a few months, then personnel changes announced
  • Settlement with Federal Trade Commission for stakeholder compensation
    • Later attempted to appeal decision for compensation

6 of 8

Did Equifax Follow SCCT?

  • Determine crisis cluster and attribution - Preventable/High Attribution
    • Initially perceived as outside attack (victim cluster), but later information showed crisis was caused by willful ignorance/laziness
  • Implement appropriate responses for cluster
    • Recommended responses for the preventable cluster are apologies and offered compensation

7 of 8

Stakeholder Response

  • Initial outrage to news was widespread and intense
    • Stakeholder attribution was high even before more information was released
  • Initial response was fairly well received
    • Outrage was slowly quelled following initially responses, goodwill slowly started to rebuild
  • Later attempts of walking back compensation reignited outrage

8 of 8

Lessons Learned

  • Blame shifting is ineffective if the matter being shifted is out stakeholder knowledge/expertise
  • Sometimes a simple response is the best response
  • If there’s one promise stakeholders won’t forget, it’s compensation (especially monetary)