According to the article, they didn’t access credit reports. Just SS numbers and other personal data. That would have been a total disaster if they did.
Well still, that’s an open door to fraud. The SSN has become too mighty. People ought to be able to designate some private additional key. If Equifax proposed a workable solution, it could turn a flop into a success.