Equifax CEO retires after massive data breach exposes up to 143 million people

Equifax Chairman and CEO Richard Smith has retired, following a massive data breach at his company that exposed the personal information of millions of people.

The credit reporting agency revealed earlier this month that hackers had accessed the information of some 143m Americans – including some who had no idea the company was collecting their data. The exposed information included social security numbers, birth dates, addresses, and even credit card numbers.

The breach – the result of an unpatched flaw in the website's software – is said to be the worst in US history.

Scrutiny has increasingly fallen on the company's leaders, with Bloomberg reporting that the breach occurred months before the date the company reported. Equifax maintains that the earlier hack was not related to the later, larger breach.

Three Equifax executives also sold almost $2m worth of shares in the company days after the breach was discovered – but before it was announced publically. The company maintains that the executives did not know about the breach at the time.

The company's chief information and chief security officers stepped down on 14 September.

Paulino do Rego Barros Jr has been named interim CEO in the wake of Mr Smith's departure. Mr Barros previously served as president of Equifax’s Asia-Pacific business. Board member Mark Feidler will serve as non-executive chairman.

"The Board remains deeply concerned about and totally focused on the cybersecurity incident," Mr Fielder said in a statement. "We are working intensely to support consumers and make the necessary changes to minimise the risk that something like this happens again."

Mr Smith, who led the company for more than a decade, will serve as an unpaid adviser during the transition. The 57-year-old was credited with growing Equifax's data collection operation and more than quadrupling the company's value.

Equifax shares fell 26 per cent after the attack was reported, and dropped an additional 2 per cent in premarket trading on Tuesday.

The FBI has opened a criminal investigation into the cyberattack. Federal legislators from both parties have requested additional information from the company. Dozens of states attorneys general are also investigating.

At least 30 lawsuits have been filed against the company. In the suits, Equifax is accused of misleading shareholders about its ability to protect consumer data and inflating its financial statements before the truth became known.

Equifax has said it will conduct an internal review and work closely with the FBI on the agency's investigation.