Many Americans may not have ever heard of credit-scoring firm Equifax Inc. ( EFX - Get Report)  before learning in September that they were among the half of the U.S. population whose identification data had been stolen when the company was hacked.
 
But "they should have been able to expect that a company that gathers the most private information about them would have state of the art protections for that information," Sen. Sherrod Brown, an Ohio Democrat, told former CEO Richard Smith during a Senate Banking Committee hearing on Wednesday, Oct. 4.
 
"A gold mine for hackers should be a digital Fort Knox when it comes to security," Brown said, continuing the comparison that House members made during a hearing a day earlier between Equifax and the U.S. bullion depository in Kentucky.
 
In both hearings, officials questioned why the company didn't disclose the hack more quickly and why it didn't have sufficient staff and digital services to handle the volume of inquiries from a theft that affected more than 145 million people and may haunt them for the rest of their lives.
 
A treasure trove of data from birth dates to driver's license and Social Security numbers used by lenders to verify the identity of loan applicants was taken in the attack, which the Atlanta-based firm said it discovered in late July and didn't disclose for more than a month. Unlike credit card numbers, which can be changed, such data points are difficult and in some cases, impossible, to alter. 
 
Early difficulties that worried consumers encountered in reaching call-center staff and getting answers to questions, as well as glitches in a website dedicated to the issue, reflect the difficulties in quickly adapting its operations to meet a mammoth demand, Smith said.
 
"The ramp-up was overwhelming for a company that was largely doing business with other companies," he said. "We had to go from 500 call-center people to almost 3,000 in two weeks."
 
What makes the hack particularly galling for victims and for lawmakers is that consumers have no choice in whether and how their data is tracked by credit bureaus like Equifax and rivals TransUnion ( TRU - Get Report) and Experian ( EXPGF) , and yet the service is vital to the U.S. economy.
 
"To easily access credit is one of the many things that make our economy and country the envy of the world," committee chairman Mike Crapo, an Idaho Republican, said. "It is also what makes this breach so shocking and so concerning."
 
Equifax shares have tumbled 21% to $111.93 since its Sept. 7 disclosure of the hack, which led to Smith's departure and his agreement to give up an annual bonus payment this year that had totaled more than $3 million each of the past two years. 
 
He has still, however, earned a considerable amount of money running a company whose relationship with average Americans is extremely one-sided, noted Sen. John Kennedy, a Louisiana Republican. 
 
Like its competitors, Equifax pays consumers nothing for the data it collects about them -- but it does charge them if they want to make sure that information is correct and that it's not being misused.
 
"It just seems incongruous to me," Kennedy said. "I don't pay extra at a restaurant to keep the waiter from spitting in my food."