In September 2017, Equifax announced a breach of sensitive personal information of 143 million US consumers, as well as consumers in the UK and Canada. The scale and scope of the breach foretell far-ranging fallout, from undermining global identity verification services to widespread fraud and economic stumbling blocks. In this report, we examine the two systemic issues that led to this disaster, provide S&R leaders with practical lessons to prevent a similar breach, examine fundamental changes in conducting business, and frame legal obligations to end these risks.