New York state is investigating the breach, and a number of states including Illinois, Pennsylvania and Connecticut have joined together to investigate. Illinois Attorney General Lisa Madigan said Monday that some 5.4 million residents there had personal information compromised.
Eric Schneiderman, New York's attorney general, warned people to be vigilant about hacking and other online and email attacks. The breach, exposing names, Social Security numbers, birth dates, addresses and driver's license numbers involves 8 million residents, he said. "Hackers are resourceful criminals who are constantly looking to exploit any vulnerabilities," he said.
The breach's effect will likely reach to banks, credit card issuers and other financial companies, which have had to contend with large-scale data compromises with increasing frequency.
"We don't have proper cyber law, we need to have a way to go after the bad guys," JPMorgan Chase CEO Jamie Dimon said Tuesday at the Delivering Alpha conference in New York presented by CNBC and Institutional Investor.
Given the growing connectedness of the world, through everything from electric grids to the internet to smart home technology and driverless cars, cybersecurity is "a big deal," Dimon said.
Separately, Treasury Secretary Steven Mnuchin said at the Delivering Alpha conference that "we are working with all of the intelligence agencies on cyberissues to keep Americans safe."
Massachusetts would be the first state to sue, but nearly two dozen class-action lawsuits have been filed against Equifax, and members of the Senate and Congress have demanded information about the nature of the breach and how it was handled within the company.
Three executives sold $1.8 million of company stock just days after the breach was discovered, though a company spokeswoman has said the executives weren't aware of the problems at the time.
Equifax has struggled to contain the damage from the breach and the reaction to the disclosure, which has erased one-quarter of its market value over the last few days.
Responding to confusion and complaints about terms that forced disputes into arbitration rather than allowing lawsuits, Equifax said no one waives their legal rights to sue by signing up for free credit monitoring and identity theft protection.
And it said credit monitoring customers won't be automatically enrolled or charged at the end of a free one-year trial. It also said it won't charge for credit report freezes and would refund those who were already charged for that product.
Correction: Equifax shares plunged on Wednesday. An earlier version misstated the day.