Equifax UK Data Breach: 15 Million UK Records, FCA Investigation, and the $575M Settlement

What Happened: The Technical Failure and Its UK Dimension

The Equifax breach was caused by an unpatched Apache Struts vulnerability (CVE-2017-5638) in a consumer dispute portal. The vulnerability had been publicly disclosed and a patch issued in March 2017. Equifax failed to patch it. In May 2017, attackers exploited it to gain access to Equifax's systems. The breach was not detected for 78 days. The UK dimension:

• Equifax Ltd (UK) had transferred UK consumer data to Equifax Inc (US) for processing — a data transfer arrangement with inadequate security oversight
• The data transferred included names, dates of birth, email addresses, telephone numbers, and partial credit card details for UK consumers
• Equifax Ltd was aware that data was being transferred to and processed in the US but failed to ensure adequate protections were in place
• When the breach occurred, Equifax Ltd failed to notify UK consumers promptly — some UK consumers were not notified until months after US consumers
• The FCA found that Equifax Ltd outsourced material functions to its US parent without adequate oversight — a direct violation of FCA outsourcing requirements

The FCA's Findings: Outsourcing Oversight Failures

The FCA's Final Notice (October 2023) focused on Equifax Ltd's failure to manage its outsourcing arrangement with Equifax Inc. This framing is significant:

• Equifax Ltd treated the data transfer as an intra-group arrangement rather than a material outsourcing — and therefore did not apply the oversight standards that FCA SS2/21 and SYSC 13 require
• The FCA found that Equifax Ltd had not conducted adequate due diligence on Equifax Inc's security controls before transferring UK consumer data
• There was no ongoing monitoring of Equifax Inc's security posture or compliance with data protection requirements
• When the breach occurred, Equifax Ltd relied entirely on information from Equifax Inc — it had no independent ability to assess the scope, cause, or remediation of the breach
• The FCA determined that these failures violated FCA Principle 3 (organising and controlling affairs responsibly) and relevant SYSC provisions

The ICO and GDPR Implications

The ICO issued a Monetary Penalty Notice of £500,000 against Equifax Ltd under the pre-GDPR Data Protection Act 1998 — the maximum fine available at the time. Under GDPR, which came into force in May 2018, the same breach would have been subject to fines of up to 4% of global annual turnover. The ICO found:

• Equifax Ltd had insufficient oversight of data processed by Equifax Inc on its behalf — a failure of controller obligations under GDPR Article 28
• The data was not adequately secured against foreseeable attack vectors — the Apache Struts vulnerability was known and patchable
• Consumer notification was delayed — UK consumers were not informed promptly when the breach was discovered
• The case reinforced that data controllers cannot outsource GDPR responsibility to processors, even intra-group processors

What Financial Firms Must Learn: Data Outsourcing Is Not a Risk Transfer

The Equifax UK case is essential reading for any financial firm that transfers client data to third parties, group companies, or cloud providers for processing:

• Intra-group is not exempt: Transferring data to a parent company, subsidiary, or affiliate does not reduce your regulatory obligations — you remain the data controller and FCA-regulated entity
• Due diligence before transfer: Before transferring client data to any processor, you must assess their security controls, obtain contractual commitments (Data Processing Agreement), and document the assessment
• Ongoing monitoring: The FCA expects ongoing monitoring of third-party data processors — not just initial due diligence. Panorays provides continuous external monitoring of processors' security posture
• Incident notification obligations: When a processor is breached, your regulatory notification clock starts from when you become aware — even if the breach was the processor's fault
• International transfers: Data transferred outside the UK/EEA requires additional legal safeguards (Standard Contractual Clauses or equivalent) — the Equifax breach highlighted the risks of inadequate international data transfer governance

Frequently Asked Questions