Standard & Poor's said late Monday that it changed the outlook on Equifax's credit rating to negative from stable after the Atlanta-based company's disclosure that data were stolen on as many as 143 million consumers, one of the biggest cybersecurity breaches in U.S. history.
Equifax's BBB+ credit rating could be lowered if costs to address the Internet attack mount or if the company's revenue declines as a result of the incident, S&P said in a statement. The score also might fall if further weaknesses are revealed in Equifax's internal controls.
"With substantial litigation expected and potential fines, as well as uncertainty surrounding costs to remediate and possible strategy shifts, we expect that debt leverage could remain elevated," S&P said.
Already, the theft from a company that not only gathers data used to determine whether would-be borrowers qualify for loans from credit cards to mortgages but also advertises data-protection services has prompted federal and state scrutiny as well as a spate of lawsuits.
"We will do what's necessary to hold Equifax accountable," said California Attorney General Xavier Becerra, who has prioritized consumer-protection efforts since his election last fall and helped to secure an $18.5 million settlement with Target Corp. over data-security failures that compromised shoppers' credit-card information.
New York Attorney General Eric Schneiderman has begun an investigation into the matter, and House Financial Services Committee Chairman Jeb Hensarling, a Texas Republican, has promised a Congressional hearing.
"This is obviously a very serious and very troubling situation," Hensarling said in a statement. "Large-scale security breaches are becoming all too common. Every breach leaves consumers exposed and vulnerable to identity theft, fraud and a host of other crimes, and they deserve answers."
Equifax's stock tumbled 21% in the two days after the breach was disclosed Sept. 7. On Tuesday they gained 1.6% to $115 a share.
The company has seen its bonds hit as well.
Prices for the company's $275 million of notes due in June 2026 have slipped by 3.2% since early last week to 97.759 cents on the dollar, according to the Financial Industry Regulatory Authority.