Equifax told in April it was 'vulnerable to data theft'

Equifax's privacy and data security were given a score of 0.0 by MSCI, a rating service - AP

Equifax was warned in April that it was “vulnerable to data theft and security breaches”, just weeks before the personal details of 143 million Americans were stolen.

In a damning audit of the credit scoring agency, analysts at MSCI, the investment index company, put Equifax’s “privacy and data security” in the bottom quartile with a score of 0.0.

“Equifax’s data security and privacy measures have proved insufficient in mitigating data breach events,” MSCI’s analysis said. “The company’s credit reporting business faces a high risk of data theft and associated reputational consequences.

“Equifax is vulnerable to data theft and security breaches. The company’s data and privacy policies are limited in scope and Equifax shows no evidence of data breach plans or regular audits of its information security policies and systems.”

MSCI gave the company’s “environmental, social and corporate governance” performance a rating of CCC, the lowest available – only 6pc of the businesses it rates had such a low score.

It also placed Equifax’s “financial product safety” in the bottom quartile, pointing out that the company had been fined $3.8m (£2.8m) earlier this year in connection with misleading practices in its marketing of product costs and credit scores.

Meanwhile MSCI rated privacy and data security at Experian, Equifax’s London-listed rival, as in the top quartile. It gave the same score to its financial product safety and awarded an overall rating of A.

The company has still not confirmed how many British consumers were affected by last week’s theft of data. American consumers had details such as names, social security numbers, dates of birth, addresses and, in some instances, driver’s licence details. It is thought that around 209,000 credit card numbers were also stolen.

Equifax says it holds the personal details of 44 million UK citizens but many British victims will be unaware of potential problems as they will not directly be Equifax customers.

The company declined to comment.