Ontario’s former privacy commissioner says Equifax was far too slow to react to a data breach that affected approximately 100,000 Canadian customers.

Equifax announced on Sept. 7 that a data breach had resulted in the compromising of personal information – including dates of birth and social insurance numbers - and credit card details of Canadian, American and U.K. customers. However, the exposed data could have been available to potential threats for several weeks.

“My understanding is that this security bug – people were notified of in early March – and then Equifax apparently responded to it in mid-May,” former Ontario privacy commissioner Ann Cavoukian told BNN in an interview on Tuesday. “We’re talking about a lapse of about nine weeks, which in this area is an eternity, because a great deal of hacking, et cetera, can occur in a nine-week period.”

Cavoukian said Equifax’s decision to wait on addressing the breach was ‘unthinkable.’

“You’re a billion dollar company and you’re dealing with million upon millions of people’s very sensitive personal records... This is as sensitive as it gets,” she said. “It’s unthinkable that you would wait before you would respond to something like this.”

The credit data company disclosed the number of Canadians that could have been affected on Tuesday and issued an apology.

"We apologize to Canadian consumers who have been impacted by this incident," Lisa Nelson, president and general manager of Equifax Canada, said in a statement.

"We understand it has also been frustrating that Equifax Canada has been unable to provide clarity on who was impacted until the investigation is complete."

Equifax said that it had relayed details to Visa and MasterCard about affected Canadians for communication to those customers’ financial institutions.

The data breach primarily accessed the information through aN application intended for use by U.S. consumers, though some Canadians’ information was also available. The company said the Canadian systems were unaffected.

"Equifax Canada can confirm that Canadian systems are not affected," the company said on its Canadian website. "We have found no evidence of unauthorized activity on Equifax's core consumer or commercial credit reporting databases.”

The Office of the Privacy Commissioner of Canada announced on its website Friday that it was probing the incident, saying “the investigation is a priority for our office given the sensitivity of the personal information that Equifax holds."

Equifax said Tuesday that it will sending notices to affected Canadians through the mail outlining steps they should take. It is also offering affected Canadians free credit monitoring and identity theft protection for the next year.

Cavoukian said the fallout of the breach could prove costly and that lawsuits have already started as a result.

“There’s no question that the banks are going to get involved, but the lawsuits are already starting,” Cavoukian said. “There are – at my last count – 23 class action lawsuits that have already been launched. One of them is seeking damages over $70 billion. The costs are going to be staggering.”

- with files from The Canadian Press