EFXEquifax

We note your senior leadership team consisting of your CEO and his direct reports (SLT) is responsible for setting the tone for strategic growth, effective operations and risk mitigation at the management level, as well as, the overall managerial responsibility for confirming that the information security program functions in a manner that meets the needs of Equifax.

Rest of the question

We also note that you described the relevant expertise of your CISO but not of the other members of the SLT. Please revise future filings to discuss the relevant expertise of such members of senior management as required by Item 106(c)(2)(i) of Regulation S-K.

We respectfully acknowledge the Staff’s comment above. While our senior leadership team (“SLT”) has responsibility for risk management at the managerial level and overall managerial responsibility for the various programs of the Company, including information security, our Chief Information Security Officer (“CISO”) is the management position responsible for assessing and managing material risks from cybersecurity threats under Item 106(c)(2)(i) of Regulation S-K.

Rest of the answer

In future filings, we will clarify that the CISO is the management position responsible for assessing and managing material risks from cybersecurity threats.

Read in the reply ↗

We note the registration statement on Form F-4 filed by Equifax do Brasil S.A. (File No. 333-270310). Please see the comments issued in connection with that registration statement and make conforming changes to this Form S-4, as appropriate.

In response to the Staff’s comment, the Registrant has revised the disclosure on pages 2, 3, 6 and 7 of Amendment

No. 1. Read in the reply ↗

We note the amended registration statement on Form F-4 filed by Equifax do Brasil S.A. (File No. 333-270310). Please see the comments issued in connection with that registration statement and make conforming changes to this Form S-4, as appropriate.

In response to the Staff’s comment, the Registrants have revised the disclosure on page 51 of Amendment No. 2 to provide a summary of the information that was evaluated by the board of directors of Equifax in determining the consideration to be offered.

With respect to Staff’s request to provide a detailed description of this information, we respectfully submit that we do not believe this level of detail is required by Form F-4 or Form S-4 nor is it customary or appropriate in our circumstances.

Rest of the answer

We acknowledge that, were disclosure required pursuant to Item 4(b) of Forms S-4 and F-4, a detailed discussion of the opinion, report or appraisal, including the underlying valuation methodologies, would be both required and customary. However, as is the case here, where there was no such report, opinion or appraisal, Item 4(b) is inapplicable.

We believe the disclosure in Amendment No. 2 satisfies the requirements of Item 4(a) to provide a summary of the material features of the proposed transaction including, specifically, the reasons for Equifax engaging in the proposed transaction. More broadly, we do not believe that the level of detail requested is required in order to provide potential investors all material information needed to make an informed decision about electing either EFX BDRs or EFX Brasil Common Shares pursuant to the terms of the Merger Agreement. As we have previously noted, with respect to the target’s shareholders, the

Registration Statement is expressly not a proxy statement and is not being used to solicit votes with respect to the BV Special Meeting or any other meeting of the shareholders of Boa Vista held in connection with the Transaction. The solicitation of votes will be made by Boa Vista solely pursuant to information provided to its shareholders in a document prepared in accordance with the requirements of the Brazilian Corporations Law and the Brazilian Securities Commission (CVM). Similarly,

Equifax’s shareholders are not required to vote to approve the transaction and the sole shareholder of Equifax Brasil is Equifax. Accordingly, the Registration Statement is solely a means to register the two alternative forms of equity consideration being offered, EFX BDRs and EFX Brasil Common Shares, and we believe this is the appropriate framework within which to evaluate the materiality of the disclosure.

As it relates to the EFX BDRs, as previously noted to the Staff, Equifax is materially larger than Boa Vista and this acquisition will not be considered significant, for example, under either Item 3-05 of Regulation S-X nor Item 2.01 of Form 8-K.

Accordingly, when assessing the materiality of the disclosure with respect to the transaction relative to an investment decision in Equifax, we do not believe additional disclosure is warranted. As it relates to EFX Brasil Common Shares, we note that the investment decision for Boa Vista shareholders electing to receive this consideration is effectively an investment in the security they already own (as post-transaction Boa Vista will be wholly-owned and controlled by EFX Brasil, and EFX

Brasil will assume the business and operations currently conducted by Boa Vista), although they are making the same investment at an 89 percent premium to the closing price of BV Common Shares immediately prior to the announcement of the transaction and a 65 percent premium to the volume weighted average trading price of BV Common Shares for the 30 trading days preceding the announcement. Accordingly, we believe additional detail with respect to how the Equifax board determined the amount of the premium to be offered is not material.

Finally, we do not believe this disclosure is customary in transactions registered on Form S-4 or Form F-4 that did not also include a proxy statement or involve the delivery of a fairness opinion or similar valuation analysis, even though we would expect the boards involved in these transactions presumably also reviewed or considered similar types of valuation analyses in determining the consideration to be offered in their transactions. See, for example, Form F-4 of StoneCo Ltd. (Registration Statement No. 333-248562), Form F-4 of Inter Platform, Inc. (Registration Statement No. 333-260701), Form S-4 for Ondas Holdings Inc. (Registration Statement No. 333-267565) and Form S-4 for International Flavors & Fragrances Inc. (Registration Statement No. 333-225728).

Read in the reply ↗

In future filings, please expand your disclosure of the 2017 cybersecurity incident to discuss the origins of the cybersecurity breach and the material events that transpired once the company received notice on March 8, 2017 of the Apache Struts software vulnerability, or tell us why such disclosure is inappropriate.

Rest of the question

In this regard, we note the material information provided by your former Chief Executive Officer in his October 3, 2017 Congressional Testimony detailing the origins of the cybersecurity breach and the company’s related actions.

In preparing our detailed disclosures regarding the 2017 cybersecurity incident, we did not believe it was material to investors to include a discussion of the origins of the incident and the events that transpired once the Company received notice of the Apache Struts vulnerability in March of 2017. However, we will add the disclosure bolded and underlined below in future filings (beginning with our Form 10-Q for the quarter ended September 30, 2018) in light of the Staff’s comment.

Set forth below is an excerpt from Company’s Form 10-Q for the quarter ended June 30, 2018, filed July 26,

Rest of the answer

2018, which included the Company’s latest disclosure regarding the 2017 cybersecurity incident. Bolded and underlined language is proposed additional disclosure in response to the Staff’s comment.

In fiscal 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of certain personally identifiable information of U.S., Canadian and U.K. consumers. Criminals exploited a software vulnerability in a U.S. website application vulnerability to gain unauthorized access to our network. In March 2017, the U.S. Department of Homeland Security distributed a notice concerning the software vulnerability. We undertook efforts to identify and remediate vulnerable systems; however, the vulnerability in the website application that was exploited was not identified by our security processes. We discovered unusual network activity in late-July 2017 and upon discovery, promptly investigated the activity and, once identified as potential unauthorized access, acted to stop the intrusion and engaged a leading, independent cybersecurity firm to conduct a forensic investigation to determine the scope of the unauthorized access, including the specific information potentially impacted. Based on our forensic investigation, the unauthorized access occurred from mid-May through July 2017. The information accessed primarily includes names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers. In addition, payment card numbers for approximately 209,000 U.S. and Canadian consumers, and certain dispute documents with personal identifying information for approximately 182,000 U.S. consumers, were accessed. The investigation also determined that personal information of approximately 19,000 Canadian consumers was impacted and approximately 860,000 potentially affected U.K. consumers were contacted regarding access to personal information. No evidence was found that the Company’s core consumer, employment and income, or commercial reporting databases were accessed.

Read in the reply ↗