Equifax sank deeper into a controversy over its handling of a data breach that could affect 143 million people, with its shares plunging almost 15 percent on Wednesday after Massachusetts announced plans to file a lawsuit.
"This may be the most brazen failure to protect consumer data we have ever seen," Massachusetts Attorney General Maura Healey said in a statement Wednesday.
The state had already begun an investigation on Friday, the day after Equifax disclosed the breach, which it discovered internally on July 29. Massachusetts estimated that the personal information of 3 million residents was exposed.
Equifax is one of the three major credit reporting companies that gather the data lenders use to judge potential borrowers' creditworthiness. The lawsuit will claim the company didn't maintain the appropriate safeguards to protect the data, violating state consumer protection and data privacy laws.
New York state is investigating the breach, and a number of states including Illinois, Pennsylvania and Connecticut have joined together to investigate. Illinois Attorney General Lisa Madigan said Monday that some 5.4 million residents there had personal information compromised.
Eric Schneiderman, New York's attorney general, warned people to be vigilant about hacking and other online and email attacks. The breach, exposing names, Social Security numbers, birth dates, addresses and driver's license numbers involves 8 million residents, he said. "Hackers are resourceful criminals who are constantly looking to exploit any vulnerabilities," he said.
The breach's effect will likely reach to banks, credit card issuers and other financial companies, which have had to contend with large-scale data compromises with increasing frequency.
"We don't have proper cyber law, we need to have a way to go after the bad guys," JPMorgan Chase CEO Jamie Dimon said Tuesday at the conference in New York presented by CNBC and Institutional Investor.
Given the growing connectedness of the world, through everything from electric grids to the internet to smart home technology and driverless cars, cybersecurity is "a big deal," Dimon said.
Separately, Treasury Secretary Steven Mnuchin said at the Delivering Alpha conference that "we are working with all of the intelligence agencies on cyberissues to keep Americans safe."
Massachusetts would be the first state to sue, but nearly two dozen class-action lawsuits have been filed against Equifax, and members of the Senate and Congress have demanded information about the nature of the breach and how it was handled within the company.
Three executives sold $1.8 million of company stock just days after the breach was discovered, though a company spokeswoman has said the executives weren't aware of the problems at the time.
Equifax has struggled to contain the damage from the breach and the reaction to the disclosure, which has erased one-quarter of its market value over the last few days.
Responding to confusion and complaints about terms that forced disputes into arbitration rather than allowing lawsuits, Equifax said no one waives their legal rights to sue by signing up for free credit monitoring and identity theft protection.
And it said credit monitoring customers won't be automatically enrolled or charged at the end of a free one-year trial. It also said it won't charge for credit report freezes and would refund those who were already charged for that product.
Correction: Equifax shares plunged on Wednesday. An earlier version misstated the day.