Equifax Admits Passports Were Breached in Data Hack

Equifax admitted in an SEC filing last week that more than 3,000 passports were also part of the massive data breach that hit the consumer credit reporting agency in September.

Equifax in February rebuffed findings by Sen. Elizabeth Warren that passports also were part of the breach.

"A months-long investigation by my office revealed that Equifax had failed to fully disclose the scope of compromised information," Warren told Vox in a statement. "After first denying the exposure of passport numbers, Equifax is finally coming clean. It’s unacceptable that the company has taken months to tell the whole truth after this massive breach."

For its part, Equifax said it didn't realize consumers were uploading passports to its platform.

Analysis "conducted on the data elements stolen from those tables found that there were no passport numbers within the passport field accessed by the attacker," an Equifax spox told Vox, adding that consumers should have known what information they uploaded.

But it's part and parcel to the slow walking of information Equifax has released about the breach, including taking 6 weeks to publicly announce that it even happened while executives sold off stock in the meantime; the company was aware of the breach in July.

To wit: Equifax originally put the number of customers affected at 143 million before ticking it up - twice - to 148 million.

In its filing to the Securities and Exchange Commission last week, Equifax divulged the extent of documents breached:

3,200 passports
38,000 driver's licenses
12,000 social security/taxpayer cards
3,000 other government-issued cards

"For years, Equifax and other big credit reporting agencies have been able to get away with profiting off using people’s private info and doing so without their explicit permission," Warren told Vox in February. "We need real consequences for when they screw up."

Equifax on Monday said it had sent a letter to several congressional committees providing the additional details of the breach.