Equifax has identified another 2.4 million US victims of the massive data breach the credit referencing firm suffered last year.
The newly-found victims had their names and partial driver's license information stolen but not Social Security numbers - which is why they have only just been identified. The total number of people affected by the breach now stands at 147.9 million.
"This is not about newly discovered stolen data," says Paulino do Rego Barros, interim CEO. "It's about sifting through the previously identified stolen data, analysing other information in our databases that was not taken by the attackers, and making connections that enabled us to identify additional individuals."
Equifax says it will now notify those affected and offer them free identity theft protection and credit file monitoring services.
Equifax first admitted that its systems had been breached on 7 September last year, with hackers exploiting a US website application vulnerability to steal the personal details of more than 100 million US consumers. Around 200,000 Visa and Mastercard cards were also compromised.
The credit rating agency received massive criticism for its handling of the breach and by November was already facing more than 240 class-action lawsuits from consumers — in addition to suits from shareholders and financial institutions.
Yet, despite breach related costs of more than $100 million, the firm this week reported fourth quarter net income of $172.3 million, up 40% on the same period the previous year.