Equifax announces its Chief Security Officer Susan Mauldin and Chief Information Officer David Webb are retiring effective immediately
The departures of the company's chief information officer and chief security officer come in the wake of a massive data breach
Context & Ripple Effects
The immediate-notice retirements of CSO Susan Mauldin and CIO David Webb land nine days after Equifax disclosed a breach exposing financial records of roughly 150 million Americans, and days after reports that three executives including the CFO sold about $1.8M in shares between the breach's discovery and public disclosure in share sales not listed as scheduled. The move reads as the first formal accountability step inside the company.
It did not stop at the security bench: chairman and CEO Richard Smith, who spent more than a decade at the company, followed within two weeks with his own immediate exit, and Equifax then rebuilt from outside — hiring former Home Depot CISO Jamil Farshchi to lead information security and later ex-IBM Watson CTO Bryson Koehler as CTO.
First-order effects
- Equifax loses both of its top technology-risk officers simultaneously while still investigating the breach — a response gap the DOJ later flagged when it found the company moved slowly in probing the incident.
- Mauldin and Webb exit without successor announcements, leaving interim coverage of security and infrastructure during active remediation.
Second-order effects
- The rebuild pulls proven security executives out of other large companies — Farshchi came from Home Depot after stints at Visa and Time Warner — tightening an already thin market for CISOs, one that also saw Twitter lose Michael Coates and Google lose Michal Zalewski around the same period.
- Replacing decade-scale institutional insiders with externally hired security leaders resets Equifax's technology agenda toward outside practices rather than internal continuity.
Third-order effects
- Breach accountability is becoming a board-level personnel function: when consumer-data firms fail at security, the CSO, CIO, and CEO seats are all in play, not just the security team.
- For credit bureaus whose product is trust in held data, executive turnover after a breach becomes part of the recovery cost — alongside acquisitions like Kount and Appriss Insights aimed at rebuilding fraud-prevention credibility.
The trend: Major data breaches are now triggering wholesale replacement of technology and security leadership at data-holding companies, with boards favoring externally recruited CISOs over internal promotion.