The CEO of Equifax, Richard Smith, is retiring in the wake of a data breach, the credit bureau’s board of directors announced Tuesday morning.
“The cybersecurity incident has affected millions of consumers, and I have been completely dedicated to making this right,” Smith said in a statement. “At this critical juncture, I believe it is in the best interests of the company to have new leadership to move the company forward.”
Related: The One Move to Make After Equifax Breach
More than143 million Americans’ personal credit records, including name, address, Social Security number, date of birth and credit history were exposed in the data breach, the company previously announced. In addition, more than 200,000 credit card numbers were stolen, Visa and Mastercard said in a private notice to banks.
In March, vulnerability on a popular server software system used by Equifax and others was exposed by researchers and quickly exploited by hackers to gain control of entire systems that hadn’t been patched. Equifax said the breach on their systems occurred from mid-May to July.
Related: Equifax Fallout: FTC Launches Probe; Websites and Phones Jammed With Angry Consumers
A massive consumer outrage boiled over following the disclosure, with Americans rushing to freeze their credit reports, only to find Equifax’s website and systems overwhelmed. The company’s Chief Security Officer and Chief Information Systems Officer abruptly retired in the aftermath.
The FBI has opened an investigation into the incident, which affected 75 percent of the adult population of the United States. Cyber experts say a state actor as culprit couldn’t be ruled out.
More than 30 states attorney generals have now opened investigations into Equifax. The company is also fending off multiple consumer class action and small claims lawsuits.
Consumer advocates and security experts said that while Smith’s retirement was a step in the right direction it didn’t solve key underlying problems.
“Equifax is trying to change the optics by a rapid move to sacrifice king as well as a few knights,” Ed Mierzwinski, Senior Fellow for U.S. PIRG, a Washington-based advocacy group, told NBC News in an email. Only action by Congress and the CFPB would suffice to keep up pressure on the credit reporting marketplace, he said.
“The CEO has very little to do with cybersecurity; ultimately he just approves a budget,” a cybersecurity expert told NBC News. “Fresh faces will roll in, but they will find themselves constrained by the budgetary restraints.”