Hack Puts Equifax at Risk of Pullback by Lenders -- Update

Banks and other financial companies are considering the possibility of moving some business away from Equifax Inc. in the wake of its data breach and to some of the firm's credit-reporting rivals, according to people familiar with the firms.

Lenders are unlikely to take any immediate action and are seeking more information from Equifax about the hack that exposed sensitive personal financial information about potentially 143 million Americans. Still, large banks, in particular, have expressed dismay privately that their customers' information was compromised, that they received no advance warning of the breach announcement, and that they still have little insight into what went wrong, these people said.

An Equifax spokesman said the company's primary focus is to support consumers. He added that it is also "engaged in ongoing discussions" with its lending customers. He said Equifax's relationships with clients have "always been based on candor" and that the company "welcome[s] the opportunity to address their questions."

Equifax has already faced widespread criticism from consumers. In the aftermath of the breach disclosure many consumers said they struggled with the firm's website and policies.

Equifax is also facing political ire: Two congressional committees are planning hearings into the hack, and the Senate Finance Committee on Monday sent the company a list of requests for information about the attack, the company's response to it, and who knew what and when about the problem.

Executives at financial firms in recent days have publicly expressed concern about the breach. James Dimon, chief executive officer of J.P. Morgan Chase & Co., the biggest U.S. bank by assets, spoke about Equifax twice at conferences on Tuesday.

Mr. Dimon said he is interested in understanding more about whether the hack is the sort of attack that could have happened to any company or if there was something specific that Equifax didn't do correctly. "All that will matter, it's obviously important," he said.

He also said, "It depends what happened and how it happened, whether they could've or should've." Mr. Dimon said that the bank was in contact with Equifax.

Speaking at a conference the day before, Capital One Financial Corp. CEO Richard Fairbank said the cost of the attack would be borne by both consumers and financial companies. "A bunch of our customers are affected," he said. "It's going to be costly to them and to us."

It is unlikely that financial firms would cease doing business with Equifax altogether. But, as contracts with the company come up for renewal, they might look to shift some of their business to rivals such as TransUnion or Experian PLC, the people familiar with the matter said.

For most loans, excluding mortgages, lenders often don't check credit reports from all three big credit-reporting firms. Moving away from Equifax would likely result in more market share to TransUnion and Experian.

The possibility of losing market share could add to the pressure on Equifax, which is already facing lawsuits and investigations related to the breach. The company's stock has fallen nearly 20% since just before the hack was announced last week.

Write to AnnaMaria Andriotis at annamaria.andriotis@wsj.com and Emily Glazer at emily.glazer@wsj.com

(END) Dow Jones Newswires

September 12, 2017 20:30 ET (00:30 GMT)