There are a few things here that
shouldn't surprise me[0], but do. A credit reporting agency's one product is personal data (basically, it's you). Leaking that data basically makes it worthless (or worth a lot less) and besides affecting the people who's data was leaked[1], it damages the product of their competitors. You'd
think that would be something that's protected with
so many layers that a breach of their web property wouldn't make much of a difference[2].
At previous employers, without going into terribly much detail, we had an asset that was treated with the kind of security that something like this should have been treated with. It was on a segregated network that could only be accessed through proxy hosts, requiring two-factor authentication. The proxy hosts were hardened (only the specific, needed, services/components installed/running, audited and firewalled to death). The devices in the secure network could not see the corporate network, let alone the Internet and the corporate network/internet could not see these devices. Even special 'management interfaces' for corporate devices were segregated. This was in addition to all of the rigor put in to securing each endpoint.
Companies need to realize that security is purely a defense related behavior. You have to be "perfect" 100% of the time, but your attacker need only be right a small number of times. The goal is to increase the number of times an attacker has to be right to get at your data. From ensuring your database accounts can only execute specific things[2], that your web servers are hardened and isolated to limit exposure, to properly configured firewalls (including application-layer firewalls/log analysis). And ensuring that employee access to high-value targets is as minimal as possible and protected thoroughly. There are both "preventative" and "reductive" technologies that need to be put in place. Preventative is designed to stop a breach, reductive is designed to ensure that if breached, the breach is either worthless (i.e. proper password hashing) or caught and interrupted before all of the data is exfiltrated. It's a lot easier to explain to investors (and your fellow countrymen) that a couple of million user accounts were exposed than it is to explain that 124 million of them left.
From the looks of it, it appears Equifax treats security like most large, non-tech businesses -- an expense that should be cut as deeply as possible. It's probably fitting that they have the word "fax" in their name. If I had a guess, they probably have mandatory security auditing requirements, they paid the least they could to meet that regulation, and got the answer they paid for (or found someone to give them the answer). I'll also guess that this PIN issue will turn out not to be the worst of the security practices in place -- I mean, how many weeks did they wait to report this[3]?
[0] I have a few years' history at a large corporation working in and around security. I've seen the ugly, though I feel that we handled things very well (incredibly well compared against Equifax!)
[1] i.e. not their customers.
[2] I'm thinking in terms of a typical SQL server, where one can eliminate table/view level access in favor of stored procedures that limit what they provide and require a level of knowledge of the operation of the system (and can be tracked by logging in a manner that identifies behavior that's not normal).
[3] And is it just me being overly cynical or does anyone else think that they waited until a historic hurricane would dominate the news cycle before going public with it? It was pretty good timing, really -- coming right off of Harvey and right into Irma, it's easy to miss this story among the other big news (one 'general news/politics' site that I expected to see all kinds of headlines on had it quite low on the fold for a day and nowhere to be found, today). Or maybe they were just waiting to give time for more of their higher-ups to sell stock. /s