Equifax

Tommy the Hamburger is here again, and this is Historical Depravity, where we dig up the polished bones of history, crack them open, and show you the rot they tried to dress up as greatness. They called these people kings, visionaries, captains of industry, patriots, reformers, whatever flattering bullshit helped the blood dry faster. I'm here to show you what they actually were. Equifax gets protected by the breach victim myth. In that version, it was just another company hit by sophisticated criminals in a cruel digital age, unlucky enough to suffer an attack at enormous scale. Yes, mistakes were made. Yes, the response was clumsy. But cyber threats are hard, the systems are complex, and everybody is vulnerable. The company becomes a target that happened to fail under pressure, not a structure built in such a rotten way that failure was practically begging to happen. That version is corporate self pity in a cheap suit. The real file is not good company breached by bad actors. The real file is a data hoarding institution that collected extraordinarily intimate personal information on people who never meaningfully chose it, failed to secure it properly, delayed public disclosure once the breach was found, and then tried to manage the fallout in a way that protected itself far more than the millions whose lives it had just made permanently worse. Myth says hacked company. Reality says negligent identity landlord treating human beings as data inventory until the inventory got ripped open. That distinction matters because Equifax was never a normal consumer business in the first place. Most people did not sign up in any morally meaningful sense to hand over their social security numbers, dates of birth, addresses, and financial histories to a private company so it could warehouse, score, and monetize them. Equifax existed because the American credit system let a few giant bureaus become information middlemen with enormous power and almost no human intimacy. The people in the files were not customers in the ordinary sense. They were the product. And that is where the obscenity starts. If a company can build a business model around your most sensitive data without your real consent, it takes on an even heavier duty to protect it. Equifax did the opposite. It treated security as a cost center and human exposure as background risk. That is what turns this from a bad incident into a depravity file. The firm did not merely get unlucky. It held other people's identities in bulk while behaving like protection was negotiable. The Apache Struts vulnerability matters because it kills the fantasy that the breach was unavoidable. The flaw was known. The alert went out. The patch existed. The issue was not some science fiction zero day conjured by invisible wizards. The issue was failure to do the basic thing. Patch the system. When a company sitting on the private lives of roughly half the country cannot reliably execute that kind of fundamental security hygiene, it has no business holding that much power over anyone. Fuck me sideways, if you cannot patch the goddamn door, maybe you should not be storing the whole neighborhood's birth certificates in your basement. And once the attackers were in, the scale of the breach exposed how much was sitting there waiting to be taken. Social security numbers. Names. Birth dates. Addresses. In many cases enough detail to fuel identity theft, fraud, credit abuse, tax fraud, and years of bureaucratic misery for people who had done nothing except exist inside the American financial system. That is another reason this file stinks so badly: the harm is not theatrical, but it is intimate. When your identity data leaks, you do not simply suffer a bad news cycle. You inherit a long administrative haunting. The victims had no meaningful ability to opt out of the arrangement, no ability to set the security budget, no control over patching discipline, and no advance warning that one of the institutions shaping their credit life was about to fail them this catastrophically. That asymmetry should dominate any honest retelling. Equifax was powerful precisely because the public was captive to its role. Captive populations deserve stronger protection, not weaker excuses. Then comes the disclosure delay, which is where negligence starts smelling like contempt. Once the breach was discovered, the company did not immediately race to inform the people whose lives were now exposed. It moved through investigation, legal positioning, communications planning, and reputation management. Some of that may be procedurally familiar in corporate crisis response. Fine. Familiar does not mean clean. If a company knows millions of people are at risk and still moves first in the language of institutional self protection, it is revealing its priorities with perfect clarity. That forty one day delay matters because every day of silence belonged to the company, not the victims. People whose social security numbers and other core identifiers had been taken did not get those days to freeze credit, monitor accounts, warn family, or start defending themselves. Equifax kept the informational advantage while ordinary people stayed blind. That is not neutral timing. That is hierarchy in action. And the stock sale stink, whether or not prosecutors could neatly package it into criminal charges, deepens the whole thing. Senior executives selling shares after discovery but before public disclosure is exactly the sort of timing that makes ordinary people understand, once again, that elite systems are built to give insiders the first shot at self preservation. Even when the official defenses start talking about knowledge boundaries and internal communication lines, the moral picture remains ugly. The people closest to the truth had ways to protect themselves before the public even knew the fire existed. This is one of the recurring American obscenities: public exposure gets socialized downward while private warning stays concentrated upward. By the time ordinary people hear about the danger, the better doors have already been used by someone else. Equifax's remediation response belongs in the indictment too, because it showed how shallow corporate contrition can be after massive harm. The company offered credit monitoring and set up consumer help structures that often felt more like legal containment than restitution. Credit monitoring is not the restoration of identity. It is not a new social security number. It is not peace. It is a thin administrative umbrella after the storm has already gone through the roof. And when the same firm that failed to guard the data presents itself as the guide to surviving the consequences, the whole thing starts to look like one more grotesque extension of the original power imbalance. There is also the larger structural depravity of the credit bureau system itself. Equifax was not just a bad apple in a clean barrel. The barrel is ugly. Private companies gather intimate financial and identity data, score people, sell assessments, shape access to housing and credit and jobs, and then tell the public to trust that the machinery is working. Meanwhile the individuals inside the machine have limited visibility, limited control, and limited recourse. Equifax's breach did not create that injustice. It illuminated it. That forced customer structure is key. If you hate Equifax, if you distrust it, if you never asked for a relationship with it in the first place, that does not free you from its grip. It can still sit in the middle of your financial life, still influence whether you get approved, still hold your data, still score you, still fail you. That makes negligence here feel more predatory than negligence in an ordinary retail company. You cannot just walk away from the bastard and take your data elsewhere. The system has already stapled you to it. That is why the company's post breach survival is so damning. Equifax paid penalties, faced headlines, and suffered a reputational hit. But the institution itself kept existing in the same basic line of work because the system still needed it. That is the kind of impunity monopoly or oligopoly can buy. If society is organized so a company can fail at this scale and still remain structurally indispensable, then the punishment was never going to match the harm. The victims, meanwhile, got a different future. They got years of fraud risk, frozen credit anxiety, ruined administrative time, false accounts, suspicious notices, constant defensive vigilance, and the knowledge that a private company they did not elect or truly choose had permanently worsened the background conditions of their lives. Some people could navigate that better than others. Poorer people, older people, less bureaucratically fluent people, and people already carrying too much stress got hit hardest. Data breaches are often described as universal events. In practice, their pain is classed. And because Equifax sits at the center of a supposedly sophisticated financial system, the whole episode also damaged public trust in a deeper way. If one of the key institutions determining creditworthiness cannot even protect the underlying identity information at basic competence level, why should anyone believe the larger arrangement is built for the public good? The answer, of course, is that it mostly is not. It is built for transaction, surveillance, scoring, and resale. Public benefit is the brochure. Extraction is the business. That is why this belongs in historical depravity and not just under big breach, bad response. The company was not merely embarrassed by cybercrime. It had accumulated extraordinary non consensual power over the identities of millions, neglected the duty that power created, then responded in the familiar language of legal and reputational management. The breach was technological in form, but morally it was old fashioned contempt: keep the asset, cheap out on protection, and let the people underneath absorb the long term consequences. File Equifax correctly, then. File it not as a fellow victim of hackers but as a negligent data landlord living off other people's identities while refusing to bear proportionate responsibility for exposing them. File the unpatched flaw as the stupid, deadly hinge point. File the disclosure delay as self protection first. File the executive stock sale timing as the smell of insider privilege, whether or not the law managed to cage it. File the whole credit bureau system as a machine that makes the public legible and profitable without giving the public real sovereignty over what is taken. And file the legacy myth for what it is: a bedtime story corporations tell when they want the public to think cyber disaster is just weather. No. Weather is weather. This was institutional power plus negligence plus delay plus a business model that already treated human identity as commodity. Equifax did not just lose data. It mishandled millions of lives and kept breathing because the people in charge of the system preferred continuity to justice. That is the depravity on record. The myth is smaller now, the stink is stronger, and the body count is still the body count. See you in the next grave I have to dig up.