They got hacked years ago. I know this for sure because I'd used a unique email address to sign up on their website: equifax@<my name>.com
No one else had that email address. Guess what, I started getting phishing emails to that exact address.
Tried letting them know, but it went nowhere.