A breach like this will affect thousands of people monetarily and suck time from them they could have used elsewhere. If you've ever dealt with something like this, you know the hours it takes to rectify the damage.
The only way corporations will learn to appreciate data security is when management teams suffer criminal penalties.
It's possible that Equifax did something really negligent and if so maybe there should be a class-action lawsuit against the company. But it's also possible they did all the things they should have done and still failed because security is really hard and maybe the attacker got lucky.
Note that I'm not making that argument, but trying to understand how this situation differs.
But since the core database wasn't hacked, it seems likely that someone had a database dump on a development machine which was outside the scope..
"Three Equifax Inc. senior executives sold shares worth almost $1.8 million in the days after the company discovered a security breach that may have compromised information on about 143 million U.S. consumers."
https://www.bloomberg.com/news/articles/2017-09-07/three-equ...
Why not?