Equifax: When Data Breaches Became Profitable
The Breach Was the Business Model
In September 2017, Equifax announced that the personal financial data of 147 million Americans, social security numbers, birth dates, addresses, driver’s licenses, had sat exposed on an unpatched Apache Struts server for 76 days. The stock fell 35 percent in a week, erasing nearly $6 billion in market value. Congressional hearings followed. The chief executive, Richard Smith, resigned. To outside observers, the breach appeared to be a catastrophic governance failure, a moment of profound institutional incompetence. But from the perspective of the company’s economic architecture, the breach was something else entirely: it was the moment the old business model became operationally impossible.
For decades, Equifax had operated as a classic data oligopolist. Along with Experian and TransUnion, it constituted a three-firm monopoly on consumer credit history in the United States. The economics were deceptively simple. Lenders, banks, auto financiers, mortgage originators, contributed borrower payment histories to Equifax’s repositories under a “give-to-get” arrangement: share your data, gain access to everyone else’s. Equifax aggregated these histories into credit files and sold them back to lenders on a per-pull basis, typically a few dollars per inquiry. The marginal cost of an additional credit pull approached zero. EBITDA margins in the U.S. Information Solutions (USIS) segment regularly touched 50 percent.
This model, however, depended on infrastructure that was, by 2017, technically indefensible. Equifax ran on a labyrinth of legacy mainframes and fragmented data centers, some dating to the 1970s. The systems that stored the nation’s most sensitive financial data were held together with digital duct tape. The breach did not merely damage the brand; it revealed that the physical architecture supporting the margin structure was rotten. The company faced a choice: continue extracting rents from decaying infrastructure and risk regulatory annihilation, or spend billions rebuilding its technology stack while margins collapsed.
They chose the latter. Over the subsequent six years, Equifax migrated its entire data infrastructure to Google Cloud Platform, retiring legacy mainframes and rearchitecting its data pipelines. The cost was brutal. USIS EBITDA margins fell from the high 40s to the mid-30s. Operating income that once flowed to shareholders was diverted to systems integrators and cloud engineers. Analysts tracking the stock watched the company’s margin profile deteriorate while management insisted the pain was temporary, a necessary precondition for “normalized” operations.
But the normalization they promised assumes something that is no longer entirely true: that the credit bureau business itself remains intact. It does not. While Equifax was rewriting its technology stack, the regulatory and competitive environment for credit reporting was shifting beneath it. The company that emerges from this transformation is not the same credit bureau that existed in 2016. It is something more profitable, more fragile, and more dependent on a specific type of exclusivity that regulators may find intolerable.
The Saturated Oligopoly
To understand what Equifax is becoming, one must first understand what it is leaving behind. The U.S. credit bureau market represents one of the most complete oligopolies in American finance. Three firms, Equifax, Experian, and TransUnion, control virtually the entire market for consumer credit data. This concentration emerged not from technological superiority but from regulatory chemistry. The Fair Credit Reporting Act (FCRA) of 1970 imposed strict compliance burdens on data aggregators while simultaneously cementing their role as the only legally recognized sources of credit history. Computerization in the 1980s and 1990s created economies of scale that prevented new entrants from achieving viability. By the time the internet arrived, the market had calcified into a tripartite structure that has resisted disruption for thirty years.
The economics of this structure rely on a specific regulatory mandate: for most mortgage originations, lenders must pull credit files from all three bureaus. This “tri-merge” requirement, ormalized by Fannie Mae and Freddie Mac since 1995, nsures that Equifax captures 100 percent of inquiry volume in the mortgage channel, regardless of whether its data is superior to Experian’s or TransUnion’s. Because mortgage credit pulls represent the highest-value segment of the credit reporting market, more detailed, more frequent, more legally consequential, the tri-merge mandate effectively guarantees Equifax a third of the most profitable revenue pool in consumer finance without requiring competitive differentiation.
The problem is that this market is saturated. Penetration rates approach 100 percent; every American with a credit card or auto loan already has a file. Unit growth in the credit bureau segment tracks roughly with GDP and credit origination volumes. When mortgage markets boom, Equifax booms; when rates rise and refinancings collapse, revenue follows. The business is cyclical infrastructure, not compound growth.
Worse, the regulatory protection is fraying. In 2022, the Federal Housing Finance Agency (FHFA) ruled that lenders selling mortgages to Fannie and Freddie could satisfy verification requirements using only two of the three credit files: “bi-merge” option. Originators can still pull all three, but they are no longer required to. In an environment where mortgage originators face margin compression and repurchase risk, the incentive to eliminate one $15 credit pull per application is significant. If bi-merge adoption becomes standard, one bureau will be excluded from approximately 25 percent of mortgage originations.
The consequences extend beyond volume loss. In a tri-merge world, pricing is cooperative; each bureau knows it will be pulled. In a bi-merge world, bureaus must compete for position in the “waterfall”: he order in which originators query databases. The excluded bureau faces a binary outcome: either cut price aggressively to regain waterfall position, or lose the volume entirely. Neither option supports the 40-plus percent margins that once defined the segment. The credit bureau business is transitioning from a regulated utility to a competitive market, and margins are unlikely to recover to historical peaks even if mortgage volumes rebound.
This is the context for the IT modernization spend. Equifax is not merely repairing a broken data center; it is rebuilding a ship while sailing into a storm. The Google Cloud migration may reduce maintenance costs and improve security posture, but it cannot restore the pricing power that bi-merge threatens to destroy. The segment that funded the company for generations has become a mature, cyclical cash cow with deteriorating competitive protections.
The Exclusive Network
While the credit bureau business faces commoditization, another segment, Workforce Solutions (EWS), has become the economic engine of the enterprise. EWS contributes approximately 45 percent of consolidated revenue but generates nearly 60 percent of EBITDA. It is growing faster, earning higher margins, and operating with significantly less competition than the credit bureau segment. More importantly, its competitive moat rests on a different, and stronger, structural foundation.
EWS operates The Work Number, a database containing income and employment records for 120 million Americans: oughly 55 percent of the nation’s income-earning population. When a lender wants to verify a borrower’s stated income, or when an employer wants to check a candidate’s employment history, they query The Work Number rather than calling human resources departments directly. The verification happens instantly, for a fee.
The economic magic lies in how Equifax obtains this data. Roughly 55 million records come from “direct corporate contributors”, arge employers (including 95 percent of the Fortune 500) who upload payroll data directly to Equifax. Another 40 million come from exclusive contracts with payroll processors like ADP. Only 25 million records overlap with competing databases. This means that for 95 million Americans, Equifax holds the only digital record of their income and employment history available to third-party verifiers.
This exclusivity creates a “waterfall” dynamic that is more powerful than the tri-merge protection in credit reporting. When a mortgage lender or background screener needs to verify employment, they do not randomly select a vendor. They ping databases in order of coverage, starting with the one most likely to have the record. Because Equifax holds exclusive files on nearly half the American workforce, it sits at the top of virtually every verifier’s waterfall. Verifiers query Equifax first; only if Equifax returns a “no hit” do they move to Experian or smaller competitors like Truework.
The implications for pricing are stark. In the credit bureau business, if Equifax charges $15 and Experian charges $14, the originator might simply rotate. In employment verification, if Equifax has the exclusive record, the verifier pays Equifax’s price or makes an expensive phone call to the employer’s HR department. The waterfall position insulates Equifax from price competition. As the company adds records, expanding from 120 million toward the 220 million Americans with income, it moves higher in more verifiers’ waterfalls, increasing query volume without increasing sales effort.
This is a self-reinforcing network effect. More records attract more verifiers; more verifiers justify higher revenue shares paid to payroll processors; higher revenue shares attract more exclusive processor contracts; more contracts add more records. The business compounds organically simply by expanding coverage, without requiring new product development or marketing spend. It is, in essence, a toll road on American employment verification.
The Twenty Percent Problem
The fragility of this model is not technological; it is contractual. Equifax does not own the 40 million records contributed by payroll processors. It rents them through exclusive agreements, typically sharing 20 percent of verification revenue with the processor. ADP, the largest payroll processor in the United States, represents roughly 25 million records under this arrangement. ADP receives approximately 20 cents on every dollar Equifax earns from verifying an ADP employee’s employment history.
The economics of this arrangement are becoming strained. ADP processes payroll for one in six American workers. It has direct relationships with the employers. It has the data infrastructure. If ADP chose to build its own verification network, or partner with a competitor on exclusive terms, it could capture 100 percent of verification revenue rather than 20 percent. The incentive to disintermediate Equifax is obvious and growing.
Equifax’s defense rests on network effects that are real but not immutable. ADP benefits from Equifax’s existing relationships with thousands of verifiers, enders, background screeners, government agencies. If ADP tried to sell verification services directly, it would need to replicate Equifax’s verifier network, a chicken-and-egg problem. Verifiers want to minimize API integrations; they prefer querying one database that covers everyone. As long as Equifax maintains the broadest coverage, ADP’s optimal strategy is to remain a supplier to Equifax’s network rather than attempt to build a parallel one.
However, this equilibrium depends on Equifax maintaining a decisive coverage advantage. If ADP defected and took its 25 million records to a competitor, or built a proprietary verification platform, Equifax’s coverage advantage would shrink. Verifiers would be forced to integrate with multiple systems. The waterfall would fragment. Pricing power would erode as verification became a commodity service with multiple competing databases.
The exclusivity contracts that protect Equifax are also vulnerable to renegotiation. If a competitor offered ADP a 30 percent revenue share, or if Equifax attempted to improve its own margins by reducing the payout to processors, the delicate balance could shift. ADP has no structural obligation to maintain exclusivity; it does so because the current arrangement is economically efficient. Should that efficiency advantage narrow, perhaps because Equifax’s cloud migration costs force margin pressure, or because a well-capitalized competitor emerges, the exclusive network could unravel rapidly.
The Bi-Merge Transition
While EWS faces the slow risk of processor defection, the traditional credit bureau business faces the immediate threat of bi-merge adoption. The FHFA’s 2022 ruling allowing two-file verification for agency mortgages represents the most significant structural change to the credit reporting industry in three decades. In the short term, originators have maintained tri-merge practices out of caution; the cost of a third credit pull is small relative to the risk of a repurchase demand from Fannie or Freddie based on missed derogatory information.
But as automated underwriting systems improve and loan manufacturing becomes more cost-sensitive, the shift to bi-merge is likely. When it happens, the competitive dynamic among the three bureaus will invert. Currently, they are complements; lenders must buy all three. In a bi-merge world, they become substitutes competing for two slots. The bureau with the weakest data quality, or the highest price, gets dropped.
Equifax’s historical positioning in mortgage lending has relied on its geographic coverage and depth of trade lines, but the differences among the three bureaus are marginal. In a forced choice, originators will optimize for cost. Price competition, largely absent from the tri-merge era, will become acute. The segment that once generated 50 percent margins will see structural compression toward 30 percent or lower, regardless of mortgage volume cycles.
This pressure makes the EWS segment’s profitability even more critical to enterprise value. If the credit bureau business becomes a low-growth, cyclical commodity while EWS grows at double-digit rates with 60 percent EBITDA margins, Equifax effectively becomes a workforce data company with a credit reporting division attached. The valuation premium accorded to the stock depends on this transition succeeding before the credit bureau business deteriorates further.
Cloud Migration as Margin Restoration
The variable determining whether Equifax can navigate this transition is the completion of its technology overhaul. The Google Cloud Platform migration, scheduled to conclude in early 2024, is not merely a security upgrade; it is an attempt to restore operating leverage to a business that had none. The legacy mainframes required massive maintenance spend, suffered frequent outages, and could not scale efficiently with query volume. Every incremental credit pull required disproportionate incremental cost.
By moving to cloud-native architecture, Equifax hopes to return USIS margins to the high 30s or low 40s, elow the historical 50 percent peak, but sufficient to fund the company’s debt load and dividend while EWS grows. However, this margin recovery assumes that bi-merge adoption remains slow and that mortgage origination volumes recover from their 2023 lows. If mortgage markets remain depressed due to persistently high interest rates, or if bi-merge accelerates price competition, the cloud migration will merely reduce costs in a business that is structurally less profitable than it was.
The IT spend also carries cultural and governance implications. For decades, Equifax operated as a data aggregator with minimal technology investment; it was a utility, not a tech company. The decision to spend billions on cloud infrastructure represented a massive capital allocation shift forced by the breach. It required replacing a generation of mainframe engineers with cloud architects, rewriting decades of COBOL logic, and migrating petabytes of sensitive data without service interruption. That this project proceeded while the company faced Congressional investigations and massive litigation suggests a board and management team capable of focusing on long-term structural survival over short-term earnings management.
Whether this discipline persists matters. If management, under pressure to show margin recovery, cuts corners on the cloud migration or attempts to extract cash from the EWS segment through financial engineering rather than coverage expansion, the competitive moats in both divisions will erode. The company’s governance must continue to prioritize data security and network expansion over share buybacks or acquisition-driven growth.
The Regulatory Guillotine
Beyond competitive threats from ADP or bi-merge adoption lies a more existential risk: regulatory dismantling of the exclusivity that makes EWS valuable. The 2017 breach exposed not only technical incompetence but the dangers of concentrated data ownership. Congressional hearings featured bipartisan expressions of hostility toward the three credit bureaus, with some legislators proposing public credit registries or mandatory data portability.
For the EWS segment, the specific threat is a regulatory mandate requiring Equifax to share its exclusive payroll records with competitors, or prohibiting exclusive contracts with payroll processors. If the Federal Trade Commission or Congress were to rule that employment data must be portable, that workers own their payroll history and can direct it to any verifier, Equifax’s 95 million exclusive records would become non-exclusive overnight. The waterfall advantage would disappear. Verification would commoditize, with price competition driving fees toward marginal cost.
Such a ruling is not implausible. The European Union’s General Data Protection Regulation (GDPR) and emerging U.S. state privacy laws (California’s CCPA, Virginia’s CDPA) establish principles of data portability that conflict with Equifax’s exclusive aggregation model. If a worker has a right to access their employment history and share it with Truework or Experian, Equifax cannot maintain its information advantage through contractual exclusivity.
The company’s defense rests on the specificity of the data. Unlike credit data, which is regulated under the FCRA, employment verification data operates in a murkier regulatory space. The Work Number’s records are derived from private payroll relationships, not public filings. But as policymakers become more aggressive about “open banking” and data portability, the assumption that Equifax can lock up employment history indefinitely becomes fragile. A single legislative action could transform EWS from a high-margin monopoly into a low-margin commodity pipe.
What the Business Actually Is
Equifax is no longer primarily a credit bureau. It is a verification network that extracts rent from the friction of confirming who people are, what they earn, and whether they pay their debts. The credit bureau business, the original Equifax founded in 1899 as Retail Credit Company, has become a cyclical utility with declining pricing power. The future value of the enterprise lies in The Work Number’s exclusive payroll data and the self-reinforcing network effects that keep verifiers querying Equifax first.
This transformation creates a peculiar risk profile. The company’s growth and margin expansion depend on maintaining exclusivity in an era when regulators and competitors increasingly view data exclusivity as anti-competitive. The 20 percent revenue share paid to ADP and other processors is a vulnerability; it represents a persistent incentive for suppliers to disintermediate the platform. The bi-merge ruling threatens the cash cow that funds the transition. And the cloud migration, while necessary, has depressed margins during the critical period when these competitive threats are emerging.
The investment case for Equifax is therefore a bet on institutional inertia. It assumes that ADP will continue to find it efficient to supply Equifax rather than compete with it. It assumes that regulators will not mandate data sharing or portability for employment records. It assumes that mortgage originators will continue pulling three credit files despite being allowed to pull two. And it assumes that the Google Cloud migration will restore operating leverage to a credit bureau business that is structurally less profitable than it was five years ago.
If these assumptions hold, Equifax represents a compounder hiding in plain sight: business growing its high-margin EWS segment at double-digit rates while its credit bureau division stabilizes as a cash-generating oligopoly. The 95 million exclusive records provide a moat that Truework and Experian cannot easily cross. The waterfall positioning creates pricing power that defies commodity logic.
But if ADP defects, if bi-merge adoption accelerates, or if Congress mandates payroll data portability, the model collapses. The 60 percent EBITDA margins in EWS would compress toward the mid-30s of the credit bureau business. The company would be left with two commoditized data utilities, heavy technology debt, and a regulatory target on its back.
The breach in 2017 forced Equifax to change its technology. The regulatory and competitive environment of the 2020s is forcing it to change its economics. Whether it can complete that transition while maintaining the exclusivity that makes the new model work will determine whether the company emerges as a dominant verification platform or as a cautionary tale about the fragility of data monopolies.
The specific mechanics of the ADP relationship merit closer inspection, for they reveal the precise point at which Equifax’s moat transitions from structural to contractual. ADP holds payroll records for approximately one-sixth of the American private workforce, yet it captures only twenty percent of the value created when those records are queried. In absolute terms, this arrangement generates hundreds of millions in annual revenue for ADP with minimal operational burden; ADP simply transmits payroll files to Equifax and collects a royalty on subsequent verifications. The arrangement appears stable because ADP lacks the verifier relationships that Equifax has cultivated over decades. Lenders, background screeners, and government agencies maintain API integrations with The Work Number, not with individual payroll processors. If ADP were to defect, it would need to persuade thousands of verification customers to integrate with a new ADP-specific endpoint, or build a consumer-facing portal that bypasses institutional verifiers entirely.
Yet the calculus shifts as the verification market matures. Consider the position of a major mortgage originator processing ten thousand applications monthly. Currently, that originator queries Equifax first, paying perhaps fifteen dollars per verification, of which three dollars flows to ADP. If ADP offered direct verification for eight dollars, capturing the full amount rather than the three-dollar royalty, the originator would save seven dollars per pull. On ten thousand applications, that represents $840,000 in annual savings, minus the integration cost of connecting to ADP’s system. For large originators, the break-even horizon on that integration might be six months. ADP’s incentive to capture the full verification fee rather than the royalty share grows as the scale of verification volume increases, and as ADP’s own cloud infrastructure makes such a pivot technically feasible.
The fragility lies in the exclusivity clause itself. Equifax’s contracts with payroll processors typically specify that the processor will not share employment data with competing verification networks. But these contracts have finite terms, and renegotiation cycles create windows of vulnerability. If Equifax, facing margin pressure from its cloud migration costs, attempts to reduce the revenue share from twenty percent to fifteen percent to improve its own economics, ADP’s incentive to defect increases non-linearly. The difference between earning twenty percent of a fifteen-dollar fee and earning one hundred percent of an eight-dollar fee suddenly narrows. Moreover, if Experian or TransUnion were to offer ADP a thirty percent revenue share, still cheaper than building direct relationships but more lucrative than Equifax’s terms, the exclusivity equilibrium could shatter. The moat is not the technology; it is the contractual allocation of surplus, and allocations change when leverage shifts.
The waterfall mechanism that protects Equifax’s pricing power deserves similar scrutiny. When a mortgage underwriter receives an application from a borrower claiming employment at a Fortune 500 company, the verification process follows a rigid hierarchy. The lender’s automated underwriting system pings Equifax first because Equifax holds the exclusive record. If Equifax returns a hit, confirming the salary and employment dates, the lender pays the fee and the process concludes. Only if Equifax returns a null result does the lender incur the cost of querying Experian or initiating a manual verification call to the employer’s HR department. This creates a curious pricing dynamic: Equifax can charge a premium precisely because the alternative is not a cheaper competitor, but a more expensive manual process involving faxed forms and phone tag with human resources administrators.
The manual verification fallback is Equifax’s true pricing anchor. A phone-based employment verification might cost a lender twenty-five dollars in labor time and delay underwriting by twenty-four hours. Against this baseline, Equifax’s fifteen-dollar instant verification looks like a bargain. But this comparison assumes that manual verification remains cumbersome. If employers begin offering automated verification portals, perhaps driven by privacy regulations that require them to provide employees with direct access to their records, the manual fallback becomes cheaper and faster. Alternatively, if open banking standards expand to include payroll data, allowing borrowers to permission their direct deposit records directly to lenders, Equifax’s instant verification becomes merely convenient rather than essential. The pricing power rests on friction, and friction is what technology removes.
The international expansion that Equifax touts as a growth vector does little to resolve these domestic fragilities. In India and Brazil, Equifax operates credit bureaus in markets with growing middle classes and expanding credit penetration. The growth rates exceed U.S. GDP, and the competitive dynamics differ, ften featuring four or five bureaus rather than three, with less regulatory capture. But these markets lack the specific mechanism that makes EWS valuable: the exclusive employment data network. The Work Number’s moat depends on the peculiar structure of American payroll processing, where a handful of providers handle the majority of corporate America, and where employers have historically been willing to outsource verification to third parties. In markets with different labor market structures, more informal employment, state-mandated verification systems, or stronger data privacy traditions, Equifax cannot replicate the waterfall model.
Moreover, international credit bureau margins tend to be lower than U.S. margins due to less concentrated market structures and weaker regulatory mandates. The tri-merge protection does not exist in Mumbai or São Paulo. While international revenue provides geographic diversification, it does not provide margin diversification; if the U.S. EWS business deteriorates, Brazilian growth cannot replace the lost EBITDA on a dollar-for-dollar basis. The company remains a leveraged play on American employment verification, regardless of its global footprint.
The regulatory distinction between credit data and employment data creates another underappreciated vulnerability. The Fair Credit Reporting Act, for all its burdensomeness, provides Equifax with a regulatory moat in the credit bureau segment. Compliance with FCRA requirements is so complex and costly that new entrants cannot easily achieve it. But the FCRA specifically covers credit reporting, not employment verification. The Work Number operates in a regulatory gray zone, governed by general consumer protection laws and state privacy statutes rather than a specific federal framework. This lack of specific regulation has allowed Equifax to maintain exclusive data contracts that might not survive scrutiny under a comprehensive federal privacy law.
Consider the mechanics of data portability. Under the California Consumer Privacy Act (CCPA), a California resident can request that Equifax delete their employment history or provide it in a portable format that can be transferred to a competitor. While relatively few consumers have exercised these rights to date, employment verification is invisible to most workers until they apply for a loan, the legal infrastructure exists to dismantle the exclusivity model. If a critical mass of workers were to demand data portability, or if a fintech competitor like Plaid or Truework were to build a consumer-facing application that helps users extract and permission their payroll data directly, Equifax’s exclusive records could become non-exclusive through regulatory mandate rather than competitive erosion.
The margin mathematics of the two segments illuminate what is at stake. USIS, the credit bureau segment, currently generates mid-30s EBITDA margins on revenue that is largely transactional and cyclical. A mortgage refinancing boom might push revenue up twenty percent in a year, but the incremental margins on that volume are constrained by the per-pull pricing structure and the fixed costs of the cloud infrastructure. EWS, by contrast, generates nearly sixty percent EBITDA margins on revenue that grows through coverage expansion: compounding effect where each new record added to the database increases the probability of verification hits across the entire network. If EWS margins were to compress to USIS levels, whether through processor defection, regulatory data sharing, or competitive price wars, Equifax would lose approximately half of its enterprise free cash flow generation capacity.
The cloud migration’s completion in early 2024 creates a inflection point for these dynamics. With the technology overhaul concluded, management will face pressure to demonstrate margin recovery in USIS while simultaneously defending EWS’s exclusivity. The temptation will be to extract more value from the EWS segment to compensate for credit bureau weakness, erhaps by reducing revenue shares to processors or increasing verification fees. But such moves risk triggering the very defection or regulatory backlash that would collapse the model. The company must thread a needle: maintaining sufficient generosity with payroll processors to preserve exclusivity, while extracting enough value from verifiers to fund the debt service on its technology transformation.
The governance structure that emerged from the 2017 breach reflects this precarious balance. Mark Begor, who assumed the chief executive role in 2018, came not from the data aggregation industry but from General Electric’s financial services arm. His appointment signaled a shift toward operational discipline and financial engineering over the insular, legacy-maintenance culture that had allowed the Apache Struts vulnerability to persist unpatched. The board composition changed dramatically, with new directors possessing cybersecurity and cloud infrastructure expertise. These governance changes were necessary but insufficient; operational competence cannot eliminate structural fragility.
The specific vulnerability of the revenue share model becomes apparent when one models a scenario in which ADP defects. If ADP were to withdraw its twenty-five million records and offer them through a proprietary network or a partnership with Experian, Equifax’s coverage would drop from one hundred twenty million to ninety-five million records. While still the largest database, this reduction would push Equifax below critical mass for certain verifiers. A mortgage lender specializing in technology workers, for instance, might find that Equifax no longer covers sufficient employees of Silicon Valley firms, forcing them to integrate with ADP directly or default to manual verification. Once verifiers begin maintaining multiple integrations, the waterfall collapses. Price competition emerges not because the databases are perfect substitutes, but because the verification process becomes sufficiently reliable through alternative channels that Equifax can no longer command a premium for marginal exclusivity.
This erosion would not happen overnight. It would begin with niche verifiers serving specific industries, technology, healthcare, professional services, where ADP’s concentration is highest. Over eighteen to twenty-four months, Equifax would see verification hit rates decline in high-value segments, forcing price cuts to maintain volume. The EBITDA margin compression would be sudden and severe, because the fixed costs of maintaining The Work Number’s infrastructure do not decline proportionally with record count. A twenty percent reduction in exclusive records could trigger a thirty percent reduction in segment profitability.
The alternative bear case, regulatory mandated data sharing, would operate even faster. If Congress were to pass legislation requiring that employment verification data be treated as a consumer right rather than a proprietary asset, Equifax would face a choice between voluntary data sharing and forced divestiture of exclusive contracts. Such legislation would likely be bundled with broader privacy reforms, using the 2017 breach as legislative justification. The political optics favoring such a move are strong: Equifax, the company that lost one hundred forty-seven million social security numbers, should not be allowed to profit from exclusive control over American workers’ employment histories.
Against these risks, the bull case relies on institutional inertia and network stickiness. ADP has not defected yet because the coordination costs of building a parallel verification network exceed the revenue gains in the short term. Regulators have not mandated data portability yet because employment verification lacks the consumer-facing salience of credit reporting errors. Bi-merge adoption has been slow because mortgage origination systems are conservative and the cost savings are marginal relative to the repurchase risk. These are reasonable assumptions, but they are assumptions about the persistence of friction rather than the creation of value.
The fundamental question is whether Equifax is a platform that deserves its position atop the verification waterfall, or merely a rent collector that inserted itself into a data flow made possible by employer laziness. If employers and payroll processors decide that verification is a core competence, or that consumer-permissioned data sharing is a regulatory requirement, Equifax’s intermediary position becomes untenable. The company would be left with its cloud-modernized credit bureau, a cyclical utility with compressed margins and bi-merge headwinds, and a declining workforce verification business that had succumbed to the commoditization it always claimed to be immune from.
The margin recovery that investors anticipate in 2024 and 2025 assumes that the credit bureau business stabilizes while EWS continues its compounding expansion. But the two segments are linked by the company’s leverage and capital allocation decisions. If management diverts cash flow from EWS network expansion to fund dividends or buybacks, the coverage growth that justifies the valuation multiple stalls. If they invest too aggressively in international expansion to offset U.S. saturation, they risk overpaying for inferior assets. The cloud migration solved the technical problem of the breach, but it did not solve the economic problem of a business model transitioning from regulatory oligopoly to contested platform.
The verdict on Equifax’s transformation will likely be rendered not by stock analysts or technology consultants, but by the next renegotiation cycle with ADP, the adoption rate of bi-merge mortgage verification, and the legislative calendar in Washington. The company has rebuilt its plumbing, but the water flowing through those pipes, exclusive employment data, mandatory credit files, verifier relationships, remains subject to claims by others who believe they own the sources. The moat is deep but narrow, and the siege engines are already at the gate.