I worked for an Equifax subsidiary for a time, and I can vouch that at least there they took security very seriously, and always worked with the best practices.

The downside was that changes were veery slow to implement :)