Equifax Board to Review Executives' Stock Sales After Hack

(Bloomberg) -- Equifax Inc.'s board of directors has formed a special committee to review the stock sales that top executives made days after the company found out it was hacked.

Directors at Equifax have retained counsel and are conducting a "thorough review" of the trades, according to a Sept. 28 letter the company's outside lawyers submitted to the top Democrat on the House Energy and Commerce Committee. The examination adds to investigations already being conducted by federal law-enforcement agencies.

“Equifax takes these matters seriously," the company said in its response to questions posed by Democrats on the panel, led by Frank Pallone, from New Jersey. “The board of directors has formed a special committee,” according to the letter, addressed to Pallone and obtained by Bloomberg News.

An Equifax spokeswoman didn't respond to a request for comment.

Congressional Scrutiny

The share sales by Equifax's chief financial offer and other executives are among the issues that have drawn the most congressional scrutiny since the company disclosed earlier this month that a data breach had compromised the personal information of 143 million Americans. Equifax's stock has fallen 25 percent since it reported the hack on Sept. 7.

The trades, which were first reported by Bloomberg, involve Equifax CFO John Gamble, President of U.S. Information Solutions Joseph Loughran and President of Workforce Solutions Rodolfo Ploder. They unloaded shares worth almost $1.8 million just days after the company says it discovered the breach on July 29. Equifax has repeatedly said the managers didn't know of the intrusion when they sold stock.

The Justice Department has opened a criminal investigation into the matter, and is working with the Securities and Exchange Commission, people familiar with the matter said earlier this month.

The Equifax breach -- one of the biggest cyberattacks in history -- has outraged the public and members of Congress. Criminals stole Social Security numbers, birth dates, drivers' license numbers and other information that is considered valuable in committing identity theft. Atlanta-based Equifax has such data because it prepares credit reports that banks rely on in determining whether consumers get loans.

Multiple Hearings

Richard Smith, who announced earlier this week he would step down as Equifax's chief executive officer, is set to testify before four separate congressional committees next week. He's expected to get grilled on the timeline of when he and others knew about the breach, and a range of other issues regarding how the company has handled the massive cyberattack that affected much of the U.S. population.

In the letter to lawmakers, Equifax attorneys at the law firm King & Spalding also disclosed more details on the company's internal procedures for how breaches are handled, while saying it's reviewing whether employees properly followed them. When there's an "unusual" cyberthreat that requires additional resources to remediate, various senior officials, including those within the legal department, are alerted and "typically outside experts are retained,” the letter said.

“There is an ongoing root cause investigation into multiple issues, including compliance with Equifax's plans and procedure guides," the letter said.

--With assistance from Jenny Surane

To contact the reporter on this story: Elizabeth Dexheimer in Washington at edexheimer@bloomberg.net.

To contact the editors responsible for this story: Jesse Westbrook at jwestbrook1@bloomberg.net, Michael Shepard