The personal information lost or compromised during the incident between 13 May and 30 July 2017 ranged from names and dates of birth to addresses, passwords, driving licence and financial details.
The Information Commissioner’s Office (ICO) found that Equifax’s systems to manage the personal information were inadequate and ineffective, while investigators found significant problems with data retention, IT system patching and audit procedures.
The investigation, carried out in conjunction with the Financial Conduct Authority, found that parent company Equifax Inc had been warned by the US Department of Homeland Security about a “critical vulnerability” two months before the cyber attack.
Information commissioner Elizabeth Denham said: “The loss of personal information, particularly where there is the potential for financial fraud, is not only upsetting to customers, it undermines consumer trust in digital commerce.
“This is compounded when the company is a global firm whose business relies on personal data.
“We are determined to look after UK citizens’ information wherever it is held.”
The attack on Equifax affected 146 million customers globally. The £500,000 fine imposed on its UK operation is the highest possible under the Data Protection Act 1998, which was in operation at the time of the data breach.
The new General Data Protection Regulation (GDPR) allows for penalties of up to 20 million euros (£17.7m).
An Equifax spokesman said: “Equifax has co-operated fully with the ICO throughout its investigation, and we are disappointed in the findings and the penalty.
“As the ICO makes clear in its report, Equifax has successfully implemented a broad range of measures to prevent the recurrence of such criminal incidents and it acknowledges the strengthened procedures which are now in effect.
“The criminal cyber attack against our US parent company last year was a pivotal moment for our company. We apologise again to any consumers who were put at risk.”