The Number That Knows You Better Than You Know Yourself
On any given day, roughly two billion times, a machine somewhere decides whether you are trustworthy. Whether you can rent an apartment in Dallas, finance a Honda Civic in Bakersfield, obtain a credit card in São Paulo, or get hired at a hospital in Cleveland. The machine does not know your face. It has never heard your voice. But it holds your Social Security number, your mortgage payment history, your last three addresses, the date you were born, and — increasingly — your employment status, your salary, and the number of hours you worked last pay period. The machine belongs, in large part, to a 126-year-old company headquartered at 1550 Peachtree Street in Atlanta, Georgia, a company that most Americans could not describe in a single sentence yet that holds files on more than 800 million individuals and 88 million businesses worldwide. That company is Equifax.
In 2024, Equifax generated record annual revenue of $5.7 billion. Its market capitalization hovers near $30 billion. It operates in 24 countries with roughly 15,000 employees. And yet the defining fact of its modern existence is this: on September 7, 2017, Equifax announced that hackers had accessed the personal data — names, Social Security numbers, birth dates, addresses, and in some cases driver's license and credit card numbers — of approximately 143 million Americans. The number later rose to 148 million, or roughly 56% of the adult population of the United States. It was, by virtually every measure, the most consequential consumer data breach in American history, and the company's response — delayed disclosure, bungled crisis communication, executive stock sales between discovery and announcement — turned the name Equifax into a synonym for corporate failure in the public imagination.
What happened next defied every reasonable expectation. The stock, which cratered 35% in the weeks following disclosure, not only recovered but more than doubled. Revenue, which was $3.4 billion in 2018, compounded at roughly 9% annually to reach its 2024 record. And the business itself underwent a $3 billion cloud transformation that its CEO calls the creation of a "New Equifax" — a phrase deployed with such frequency that it functions less as description than incantation. The paradox at the center of this story is almost too neat: a company that suffered catastrophic failure in its most fundamental obligation — protecting data — used that failure as the catalyst for a technological reinvention that may have made it more competitively formidable than it was before the breach. The question is whether the moat that Equifax rebuilt is genuinely impregnable, or whether it merely looks that way because nobody has tried the door again.
By the Numbers
Equifax at a Glance
$5.7BFY2024 revenue (record)
~$30BMarket capitalization (2024)
~15,000Employees worldwide
24Countries of operation
148MAmericans affected by 2017 breach
$3B+Cloud transformation investment (2018–2024)
168MCurrent records in The Work Number
~9%Revenue CAGR since 2018
The Grocer's Ledger and the Architecture of Trust
The credit bureau is an institution born from the mundane anxiety of grocers. In 1874, if you wanted to buy provisions on store credit in a small American city, the cashier would reach beneath the counter and consult a little blue book — a ledger of names, occupations, and payment habits compiled by local merchants' associations. The system was intimate and imperfect, reliant on gossip, personal knowledge, and the subjective judgment of men who knew their customers by name.
Cator Woolford understood this system's limitations and its commercial potential. A former bank employee from Woolford, Maryland, Cator had supervised the compilation of a creditworthiness list for a grocer's association in Chattanooga, Tennessee, selling copies to other merchants to cover costs. With his brother Guy, a lawyer six years his junior, he relocated to Atlanta and on March 22, 1899, opened the Retail Credit Company in a single room on the fifth floor of the Gould Building at 10 Decatur Street. The methodology was elemental: the Woolfords copied credit information from the ledger books of Atlanta's food retailers onto individual slips of paper, then arranged them alphabetically. Merchants' assessments were distilled into simple notations — "Prompt," "Slow," or "Requires Cash" — and published as "The Merchant's Guide," sold for $25. Individual credit reports were available on demand.
The insight was not original but the execution was relentless. Within decades, Retail Credit Company had expanded from grocers to life insurance, auto insurance, and general consumer investigations. It went public in 1965. By the late 1960s, it maintained files on tens of millions of Americans, and it had attracted the kind of attention that comes with that scale.
In 1970, Congress passed the Fair Credit Reporting Act — the first federal law regulating the credit reporting industry — in large part because of concerns about companies like Retail Credit. Lawmakers worried about the vast troves of personal data these firms had accumulated with zero consumer consent. The Federal Trade Commission accused the company of incentivizing employees to dig up negative information about consumers. The charges were eventually dropped, but the reputational damage lingered. In 1975, the company renamed itself Equifax — a portmanteau of "equitable" and "factual" — in what some observers described as an effort to distance itself from its regulatory entanglements.
The name change was cosmetic. The business model was unchanged and, in its essentials, unchanged to this day: gather data about individuals who never asked to be monitored, package it into reports and scores, and sell those packages to businesses that need to make decisions about those individuals. The consumer is the product. The lender, the insurer, the landlord, the employer — they are the customers. This asymmetry is the foundation stone of the entire credit reporting industry, and it explains both Equifax's extraordinary profitability and the peculiar public rage that surfaces whenever the company fails.
📜
From Ledger to Algorithm
Key moments in Equifax's institutional evolution
1899Cator and Guy Woolford found Retail Credit Company in Atlanta.
1965Company goes public on the New York Stock Exchange.
1970Fair Credit Reporting Act passes, partly in response to industry practices.
1975Retail Credit Company renames itself Equifax.
1997Spins off ChoicePoint as a separate entity.
2001Spins off Certegy (payment services).
2007Acquires TALX Corporation (now Workforce Solutions) for ~$1.4B.
2017Massive data breach exposes 148 million American consumers.
The Oligopoly's Invisible Architecture
To understand Equifax, you must understand the structure it inhabits. The American consumer credit reporting industry is, in practice, a triopoly: Equifax, Experian, and TransUnion. Approximately 400 smaller agencies exist — regional specialists, niche players focused on payday loans or utility payments — but the three majors collectively dominate. They hold files on virtually every American with a credit history. The data they compile underpins roughly $4 trillion in annual consumer lending decisions.
The triopoly is not the product of superior technology or better products outcompeting inferior ones. It is the product of network effects so deep they are almost geological. Lenders report data to the bureaus because other lenders pull data from the bureaus; the bureaus have data worth pulling because lenders report to them. This circularity creates a self-reinforcing system that is extraordinarily difficult to disrupt. A new entrant would need to convince thousands of financial institutions to simultaneously furnish data and pay to access it — a chicken-and-egg problem of almost comical severity.
There is a peculiar feature of this oligopoly worth dwelling on. The three bureaus hold nearly identical information about most consumers, because the same banks, credit card companies, and mortgage lenders report the same payment histories to all three. The files are not perfectly overlapping — roughly 3% to 5% of data differs across bureaus, owing to variations in data furnisher relationships — but they are close enough that the actual credit report on any given individual looks substantially the same regardless of which bureau generates it. This creates a strange competitive dynamic: the bureaus compete less on the raw data (which is largely interchangeable) and more on analytics, product packaging, speed of delivery, and — crucially — the differentiated data assets that sit outside traditional credit files.
This last point is the key to understanding Equifax's strategic evolution over the past two decades. If the core credit file is a commodity — and it largely is — then sustainable competitive advantage must come from data the other bureaus don't have.
The Crown Jewel That Nobody Talks About
In 2007, Equifax acquired TALX Corporation for approximately $1.4 billion. At the time, TALX was known primarily as an employer services company — tax credits, unemployment cost management, payroll-related HR functions. Embedded within TALX, however, was a database called The Work Number, and it is not an exaggeration to say that this single asset has become the most strategically important piece of Equifax's business.
The Work Number is a centralized repository of employment and income data, contributed directly by employers through their payroll systems. When Equifax acquired TALX, the database contained records from a few thousand employers. By 2024, approximately 3 million employers contribute data to The Work Number every pay period, covering roughly 168 million current records. The database captures not merely whether an individual is employed, but by whom, at what salary, for how long, and — in many cases — how many hours they worked in a given period.
The Work Number might actually be the crown jewel asset today.
The strategic significance is profound. Employment and income verification is a critical step in mortgage origination, auto lending, government benefits administration, tenant screening, and pre-employment background checks. Before The Work Number, a lender seeking to verify a borrower's income had to call the borrower's employer, request a letter, and wait days or weeks for a response — a manual process that was slow, error-prone, and expensive. The Work Number automates this entirely. A lender can verify income and employment in seconds.
The beauty of the model — from Equifax's perspective — is that it is a genuine monopoly. There is no second Work Number. TransUnion and Experian have attempted to build competing employment verification databases, but the network effects are punishing. Employers contribute data to The Work Number because lenders and verifiers pull from it; lenders pull from it because that's where the employer data lives. Each new employer added makes the database more comprehensive, which attracts more verifiers, which gives employers more reason to participate. The flywheel has been spinning for nearly two decades, and the competitive gap has only widened.
This asset lives within Equifax's Workforce Solutions segment, which generated $2.3 billion in revenue in 2023 — roughly 44% of total company revenue — and has been the fastest-growing business unit for years, with strong non-mortgage organic revenue growth of approximately 10% in 2023. The verification services business within Workforce Solutions is the engine: it processes verifications for mortgage lenders, auto lenders, government agencies administering benefits like Medicaid and SNAP, and employers conducting background checks. In 2024, The Work Number fulfilled 25.5 million verifications for people seeking government assistance alone.
The pricing power is considerable. Equifax can charge $30 to $50 or more per verification — sometimes significantly more for complex mortgage verifications — because the alternative is a manual process that costs the verifier far more in labor and time. And because the data is contributed by employers at no cost to Equifax (employers participate because it reduces their own HR burden of responding to verification requests), the gross margins on verification services are exceptional.
76 Days of Silence
The breach began, as so many catastrophic failures do, with a patch that wasn't applied.
On March 7, 2017, the Apache Software Foundation publicly disclosed a critical vulnerability in Apache Struts, a widely used open-source web application framework. The vulnerability — CVE-2017-5638 — was severe: it allowed remote code execution, meaning anyone who exploited it could run arbitrary commands on a vulnerable server. A patch was available the same day. The Department of Homeland Security notified Equifax of the threat on March 8. On March 9, Equifax's Global Threat and Vulnerability Management team emailed employees, instructing all who ran Apache Struts to install the patch within 48 hours, per company policy.
Equifax did not patch its Automated Consumer Interview System, or ACIS — the web application that handled consumer dispute inquiries. The reason, as a subsequent Senate investigation revealed, was almost banal: the employee who knew that ACIS ran on Apache Struts was not on the email distribution list for vulnerability alerts. The scan that Equifax ran to identify vulnerable systems failed to detect ACIS because the scanning tool was inadequate.
On May 13, 2017, attackers exploited the unpatched vulnerability and entered Equifax's network. Once inside ACIS, they found unencrypted usernames and passwords that granted access to dozens of other databases. Over the next 76 days, the attackers executed approximately 9,000 queries, exfiltrating data on what would eventually total 148 million American consumers, plus limited data on British and Canadian residents. Equifax's network monitoring system — which should have detected the anomalous traffic — had been inoperative for ten months because an SSL certificate had expired and nobody had renewed it.
Equifax discovered the breach on July 29, 2017. It would wait 40 days to tell the public.
In the interim, three senior executives sold shares worth a combined $1.8 million. The company's head of corporate communications said the three — CFO John Gamble, president of U.S. Information Solutions Joseph Loughran, and president of Workforce Solutions Rodolfo Ploder — "had no knowledge that an intrusion had occurred at the time they sold their shares." Two lower-ranking managers were later found guilty of insider trading. CEO Richard Smith initially described the breach as "disappointing." He would resign within weeks.
This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do.
The public disclosure, when it finally came on September 7, was itself a case study in crisis mismanagement. Equifax directed consumers to a new website — equifaxsecurity2017.com — where they could check if they were affected. The site's security protocols were themselves criticized as inadequate. Equifax's own social media team, on multiple occasions, accidentally directed consumers to the wrong URL: securityequifax2017.com, a domain registered by a security researcher to demonstrate the absurdity of the situation. That fake site received 200,000 hits before being taken down. Language on the real site initially implied that consumers waived their right to sue by checking their status — language hurriedly changed after media flagged it.
The scale of what was exposed was staggering. According to Equifax's own later filing with Congress: 146.6 million names and dates of birth. 145.5 million Social Security numbers. 99 million addresses. 17.6 million driver's license numbers. 209,000 credit card numbers. As Gartner analyst Avivah Litan put it at the time: "On a scale of one to 10, this is a 10 in terms of potential identity theft."
The Breach That Changed Nothing and Everything
The aftermath unfolded along two tracks that ran in opposite directions.
On the public track: outrage, investigations, and consequences that sounded significant in press releases. The FTC, the Consumer Financial Protection Bureau, and all 50 state attorneys general launched investigations. The Senate Permanent Subcommittee on Investigations produced a damning staff report titled "How Equifax Neglected Cybersecurity and Suffered a Devastating Data Breach," documenting years of known cybersecurity deficiencies that went unaddressed. A 2015 internal audit had identified a backlog of over 8,500 vulnerabilities with overdue patches; no follow-up audit was ever conducted. The House Committee on Oversight concluded the breach was "entirely preventable."
In July 2019, Equifax agreed to a global settlement: up to $700 million in total, including a Consumer Restitution Fund of up to $425 million, $175 million to the states, and $100 million in civil penalties to the CFPB. Ten years of free credit monitoring for affected consumers. It was described as the largest data breach settlement in history.
In February 2020, the Department of Justice indicted four members of China's People's Liberation Army — Wu Zhiyong, Wang Qian, Xu Ke, and Liu Lei, of the PLA's 54th Research Institute — for the hack. None have been apprehended.
On the business track, however, something remarkable happened. Or rather, didn't happen. Equifax's core business barely flinched. The stock took an initial 35% hit and recovered within 18 months. The company continued to receive large government contracts — including IRS contracts for identity verification — even as the investigations proceeded. Consumer Reports noted, with evident frustration, that "Americans remain largely in the dark about the practices of the credit reporting industry — and, more generally, largely unable to control the use of their personal information. Equifax itself has suffered minimal consequences and continues to do business more or less as before."
The explanation for this resilience is structural, not moral. Equifax's customers are not the 148 million individuals whose data was exposed. Its customers are the banks, lenders, government agencies, and employers who pay for credit reports, fraud analytics, and employment verifications. Those customers had no practical alternative. The triopoly structure means that if JPMorgan Chase stops buying data from Equifax, it loses access to credit information it cannot obtain elsewhere. The Work Number has no substitute at all. The consumers whose data was breached — who never chose to be Equifax's product, who never opted in, who cannot meaningfully opt out — have even less leverage. Their financial lives require them to exist in Equifax's databases whether they like it or not.
This is the uncomfortable truth at the center of the credit bureau business model: the consumers who bear the risk of data exposure are not the customers who generate the revenue, and the customers who generate the revenue have no economic incentive to punish the company for failures that harm consumers. The misalignment of interests is not a bug. It is the architecture.
The GE Man and the $3 Billion Rebuild
Mark Begor arrived at Equifax on April 16, 2018, seven months after the breach disclosure, three CEOs into the crisis (Smith resigned, Paulino do Rego Barros Jr. served as interim). He was 59 years old, a Syracuse graduate with an MBA from Rensselaer Polytechnic Institute, and he carried the imprint of the institution that had shaped him: 35 years at General Electric, where he had run businesses ranging from retail credit cards (GE Capital Retail Finance, later spun off as Synchrony Financial) to real estate lending to the $8 billion energy management division. He had been a GE officer for 19 years, a member of the Corporate Executive Council for 10, and had served as CFO of NBCUniversal. Before Equifax, he spent two years at Warburg Pincus, the growth equity firm. He was, in other words, a GE-trained operational executive with deep experience in financial services and a private equity investor's instinct for transformation.
We are a public trust in many regards and we need to work to earn that trust back.
What Begor did at Equifax was arguably more radical than the public recognized. Rather than treating the breach as a security problem to be patched, he treated it as the forcing function for a wholesale technological rebuild. The company would migrate its entire infrastructure — 63 legacy data centers, hundreds of siloed databases, decades of accumulated technical debt — to the cloud. Not a lift-and-shift migration, but a genuine re-architecture: rebuilding applications, creating a unified "data fabric" that linked previously disconnected data sources, and adopting cloud-native development practices.
The investment was staggering: approximately $1.5 billion in the first three years, scaling to approximately $3 billion cumulatively over seven years by 2024. Equifax selected Google Cloud as its primary infrastructure partner, drawn in part by Google's nine-layer, zero-trust security architecture. The company also partnered with EPAM Systems to build the data fabric and engaged in an extensive retraining effort — 700 engineers earned cloud certifications — while "refreshing" more than half of its 7,500-person technology team. Bryson Koehler, hired as CTO in 2018, described the philosophy bluntly: "Part-way measures would not be acceptable. We needed to go all in on the cloud."
The results, measured by operational metrics, have been striking. Customer onboarding processes that previously took six months now complete in under a day. Latency improvements of 400% to 600%. An eight-fold increase in fraud detection for customers of Equifax security services. By the end of 2024, North American cloud migration was substantially complete, and roughly 70% of revenue was running on the new Equifax Cloud infrastructure (as of the end of 2023).
But the cloud migration was not merely a defensive move. It was an offensive one. The unified data fabric — a single architecture linking credit, employment, income, property, auto, and commercial data — enabled Equifax to build new analytical products faster and to deploy AI and machine learning at scale. The company has been delivering more than 100 new product innovations per year since 2021, with a "Vitality Index" (revenue from products introduced in the last three years) of 14% in 2023, well above its 10% target. By 2023, 70% of new models were built using AI and ML tools, up from 60% the prior year.
The New Equifax, in Begor's telling, is no longer a credit bureau that also does other things. It is a cloud-native data, analytics, and technology company that happens to have started with credit reports.
Buying the Perimeter
Parallel to the cloud transformation, Begor executed an aggressive acquisition program that reshaped Equifax's portfolio. Since 2021, the company has completed 14 strategic acquisitions totaling nearly $4 billion. The pace and pattern reveal the strategy: each deal either adds differentiated data that competitors cannot easily replicate or extends Equifax's reach into adjacent verification and identity markets.
The acquisitions fall into several clusters. Employment and income data expansion: deals to broaden The Work Number's coverage. Fraud prevention and identity: the $640 million acquisition of Kount in January 2021, an AI-driven fraud prevention and digital identity company. International credit bureau consolidation: the purchase of Boa Vista Serviços, the second-largest credit bureau in Brazil, and Profile Credit, the leading credit information provider for the Canadian agri-food industry. Each acquisition is positioned as a "strategic bolt-on" — Begor's favored phrase — designed to add differentiated data or capabilities to the existing platform.
Major deals since 2021
| Acquisition | Year | Strategic Rationale |
|---|
| Kount | 2021 | AI-powered fraud prevention and digital identity |
| Appriss Insights | 2021 | Incarceration and risk data |
| Boa Vista Serviços | 2023 | Second-largest credit bureau in Brazil |
| Profile Credit | 2023 | Canadian agri-food credit information leader |
| 14 total deals | 2021–2024 | ~$4B invested; ~$300M+ incremental run-rate revenue |
The cumulative effect is a company whose revenue mix has shifted materially. Workforce Solutions, powered by The Work Number and its verification empire, is now the single largest segment. The company has diversified far beyond traditional credit pulls on mortgages and credit cards into government services, talent solutions, identity fraud prevention, and a sprawling international portfolio. When Begor says Equifax has moved "well beyond a traditional credit bureau," the numbers support the claim.
The Mortgage Dependence Problem
There is, however, a significant vulnerability embedded in the business model, and it has a name: the U.S. mortgage market.
Equifax derives substantial revenue from mortgage-related activity — credit pulls on originations and refinances, employment and income verifications for mortgage underwriting, property data, and fraud analytics. When mortgage volumes surge, as they did in 2020 and 2021 during the pandemic-era refinancing boom, Equifax's revenues surge with them. When mortgage volumes collapse, as they did in 2022 and 2023 as the Federal Reserve raised interest rates, Equifax feels the pain acutely.
The sensitivity is striking. In 2023, U.S. mortgage inquiries were down 34% year-over-year, and Equifax estimated the impact on its revenue at approximately $500 million. Despite this headwind, the company still grew total revenue 4% in constant currency to $5.265 billion — a testament to the strength of its non-mortgage businesses. But the mortgage dependency introduces a cyclicality into what management pitches as a steady compounding machine.
Begor's strategic response has been to accelerate non-mortgage growth — expanding government verification services, talent solutions, international operations, and identity fraud prevention — to reduce the company's relative exposure to mortgage cycles. The 7% organic non-mortgage constant-currency growth in 2023 suggests progress, but the structural linkage remains. A sustained housing recovery could supercharge Equifax's earnings; a prolonged downturn could suppress them for years.
The Data That Doesn't Belong to You
Josh Lauer's
Creditworthy: A History of Consumer Surveillance and Financial Identity in America traces the evolution of credit reporting from its nineteenth-century origins as a network of local merchants sharing gossip about customers to the modern consumer data industry. Lauer's central argument — that credit bureaus did something more profound than merely assess risk; they "invented the modern concept of financial identity" — illuminates the philosophical tension at the heart of Equifax's business.
The tension is this: Equifax's entire value proposition rests on possessing information that individuals did not voluntarily provide and cannot effectively control. You do not sign up for Equifax. You do not choose what data it collects about you. You cannot opt out of its databases without opting out of the modern financial system entirely — no credit cards, no mortgages, no car loans, no apartment leases, no employment at many firms that run credit checks. The FCRA gives you the right to dispute inaccuracies and to request your own credit report, but it does not give you the right to prevent Equifax from collecting your data in the first place.
This asymmetry has been challenged repeatedly — by regulators in the 1970s, by consumer advocates in the 2000s, by Congress after the 2017 breach — and it has survived every challenge. The reason is structural: the credit system provides genuine economic value. Lenders make better decisions with credit data than without it. Borrowing costs are lower in a system with robust credit information infrastructure than in one without it. The three bureaus are, in a real sense, public utilities that happen to be organized as private corporations. The information they hold is essential to the functioning of the consumer economy.
The 2017 breach did not change this calculus. If anything, it underscored the bureaus' indispensability. The settlement required Equifax to provide free credit monitoring and credit freezes, but it did not alter the fundamental collection model. The CFPB's January 2025 enforcement action against Equifax — a $15 million fine for violations of the Fair Credit Reporting Act, including failure to investigate consumer disputes and providing inaccurate credit scores — demonstrates that the regulatory pressure continues, but the fines are rounding errors on a $5.7 billion revenue base.
The consumer's position is essentially unchanged from 1899, when Cator Woolford copied names from grocer's ledger books onto slips of paper. The technology has advanced by orders of magnitude. The power dynamic has not.
The Verification Monopoly's Next Act
The Work Number's growth trajectory suggests where Equifax's future value creation is most likely to concentrate. The database grew from 3 million contributing employers to 168 million current records by 2023, with 11% growth in records that year alone. The expansion into government verification — Medicaid, SNAP, unemployment benefits, and other programs — has opened an enormous addressable market. In 2024, Equifax fulfilled 25.5 million verifications for people seeking government assistance, a number that has grown rapidly as state agencies adopt automated verification to reduce fraud and accelerate benefits processing.
The logic for government agencies is straightforward. Manual income verification for benefits eligibility is slow and expensive. The Work Number can verify employment and income in real time. The result is faster benefits processing for consumers and lower fraud for taxpayers. It is the rare business where the interests of the buyer (the agency), the subject of the data (the benefits applicant), and the data provider (Equifax) are substantially aligned — at least in theory.
But the monopoly position creates its own political risk. Critics have raised concerns about a private company serving as the de facto gatekeeper to government benefits, about the accuracy of the data (errors in The Work Number could cause legitimate applicants to be denied benefits), and about the pricing power that monopoly confers. Equifax can charge government agencies substantially for a service they have no practical alternative to. The CFPB's ongoing scrutiny of the company's practices — including the 2022 coding error that sent inaccurate credit scores to lenders during a three-week period, affecting consumers applying for mortgages, auto loans, and credit cards at institutions including JPMorgan Chase, Wells Fargo, and Ally Financial — suggests that regulatory patience has limits.
The verification business is Equifax's engine of differentiated value, its true competitive moat, and the asset most likely to drive above-market growth for the next decade. It is also the asset most vulnerable to political backlash if the monopoly is perceived to be extractive rather than beneficial.
EFX.AI and the Cloud's Second Act
With the North American cloud migration substantially complete, Equifax's strategy has pivoted from building infrastructure to leveraging it. The company's EFX.AI initiative — combining proprietary models with Google Cloud's Vertex AI — represents its bet that a unified data fabric, when subjected to advanced machine learning, will yield analytical products that competitors cannot replicate.
The claim has some empirical support. In 2023, Equifax delivered a record number of new product innovations for the fourth consecutive year, with 70% of new models built using AI and ML tools. The unified data fabric means that a single query can now draw on credit, employment, income, property, auto, and commercial data simultaneously — something that was impossible when data lived in hundreds of siloed databases across 63 data centers.
The competitive implication is significant. Experian and TransUnion are pursuing their own cloud migrations and AI strategies, but neither possesses Equifax's combination of a substantially complete cloud transformation and a monopoly employment verification asset and a unified data fabric linking multiple data domains. Whether this translates into durable analytical superiority — models that predict default risk, detect fraud, or verify identity meaningfully better than competitors' — remains to be proven at scale. But the architectural foundation is in place, and the capital has been deployed.
The World Beyond Atlanta
Equifax's International segment generated approximately $1.2 billion in revenue in 2023, operating across 24 countries in Latin America, Europe, the UK, Canada, and Asia Pacific. The international portfolio is a patchwork — in some markets (Canada, the UK, Australia) Equifax holds strong positions as one of the leading credit bureaus; in Latin America (particularly Brazil, with the Boa Vista acquisition, and Argentina, Chile, Peru), it has been aggressively building scale.
The international business offers both diversification and growth. In developing markets, credit infrastructure is still being built, and Equifax can bring its data aggregation and analytics capabilities to populations that are gaining access to formal credit for the first time. In 2022, 16.7 million Latin American consumers gained access to credit through data and analytics provided by Equifax. The total addressable market for credit bureau services globally dwarfs the mature U.S. market, but the competitive dynamics vary enormously by country — local incumbents, regulatory regimes, data privacy laws, and cultural attitudes toward credit reporting all shape the landscape.
The Boa Vista acquisition deserves particular attention. As Brazil's second-largest credit bureau, Boa Vista gives Equifax a substantial foothold in Latin America's largest economy at a time when Brazil's credit market is expanding rapidly. The deal was structured through an S-4 filing that registered Equifax shares, reflecting the strategic significance management placed on Brazilian market positioning.
The Paradox of the Indispensable Middleman
Equifax occupies a peculiar position in the American economy. It is simultaneously essential and resented. Indispensable and mistrusted. A company that 56% of American adults have reason to personally distrust — because it lost their most sensitive data — yet cannot escape, because the systems of modern credit, employment, and identity verification route through its databases whether they like it or not.
The financial performance reflects this. Revenue has compounded from $3.4 billion in 2018 to $5.7 billion in 2024. The cloud transformation is substantially complete. The Work Number's moat deepens with every payroll cycle. The acquisition program has diversified the business far beyond traditional credit reporting. AI and machine learning capabilities are being layered onto a unified data fabric that competitors lack.
And yet the questions that the 2017 breach raised — about accountability, about the ethics of involuntary data collection, about the structural insulation of credit bureaus from the consequences of their own failures — remain unanswered. The regulatory fines are manageable. The consumer lawsuits are settled. The stock has more than recovered. The lesson the market has drawn is that the moat is structural and the breach was survivable. The lesson consumers might draw is different.
On a shelf somewhere in the archives of the Georgia Historical Society, there is likely a copy of the Woolfords' original "Merchant's Guide" — a slim volume of names, addresses, and payment habits, sold for $25, compiled from the ledger books of Atlanta's grocers. Today, Equifax manages 1,200 times more data than the Library of Congress. The notations have changed from "Prompt" and "Slow" to three-digit FICO scores and real-time income verification. The power dynamic — the grocer watching the customer, the customer unaware of being watched — has not.
