Nearly three months after credit reporting giant Equifax revealed that its consumer data was hacked, the company said Tuesday that an investigation has found that more than 19,000 Canadians were affected by the incident.
The disclosure raises a number of questions about why it took so long to figure out exactly how many Canadians had such sensitive data breached. Equifax said Wednesday that the names, addresses, expiry dates, and Social Insurance Numbers associated with 11,670 Canadian credits cards were stolen.
That number is in addition to 8,000 Canadians reported in October who had their personal information compromised during the attack, which occurred between May and the end of July, when Equifax discovered the breach. The company did not reveal the attack to the public until months later, on Sept. 8.
When initial news of the attack was released, Equifax estimated that 100,000 Canadians were affected.
Equifax eventually downsized that number to 8,000, following a forensic review by cybersecurity firm Mandiant.
It’s unclear why Equifax had estimated such a high number of breaches, and why it’s taken so long to find out exactly how many Canadians have been impacted.
The breach was global in nature. Some 145.5 million U.S. consumers and nearly 400,000 UK residents were also impacted.
In Tuesday’s statement, Equifax said that it will notify its affected customers by mail, in addition to offering them free credit monitoring and theft protection services.