Dozens of consumer privacy groups are calling for a US Federal Trade Commission (FTC) investigation into the data breach at credit agency and data broker Experian, saying that intrusions into other parts of the company’s data “would be a terrifying and unmitigated disaster”.

In a letter from the US Public Interest Research Group (PIRG) co-signed by 25 different data security and consumer advocacy organizations, the groups publicly questioned Experian’s assertion that its consumer credit database of 200 million people was safe from thieves.

Experian has said that the hack was at a subsidiary, identified by the company as Decisioning Solutions, which it acquired in 2013. At least five different groups of litigants are currently seeking class-action status; some are against Experian and some are against T-Mobile.

Among the organizations endorsing an investigation are Consumer Watchdog, the Center for Digital Democracy, the World Privacy Forum and the Electronic Privacy Information Center.

“We believe that it is incumbent on the regulatory agencies to fully investigate this breach, including whether other Experian databases have been breached,” wrote the signatories. “As you know, Experian is one of the three nationwide consumer reporting agencies (CRAs), each holding data on over 200 million consumers. A data security breach that affected Experian’s credit report files would be a terrifying and unmitigated disaster.”

The call comes as details are emerging about what former contractors characterize as a lax approach to security implementation at Experian, especially at companies it acquires. The data giant spends liberally on security, many say, but less so on implementation.

Brian Krebs, a security researcher, interviewed several former Experian contractors, who told him that the high security standards held at the board level were not a part of its daily operations. “What the board of directors at Experian wanted security-wise and the security capabilities on the ground were two completely different things,” one contractor, Jasun Tate, told Krebs.

The company had a mandate to grow by acquiring other businesses with proprietary data sets, Krebs writes, but when it came to securing that data at Experian after an acquisition, Tate said that “the subsequent integration of the business into our core security architecture was just a black box of magic in terms of how it was to be implemented. And I’m not saying successful magic at all.”

The company has been breached before, also at a company it had acquired recently, and is currently battling a class-action suit alleging misconduct. In that case, the data wasn’t stolen, it was simply sold by Experian subsidiary CourtVentures to Hieu Minh Ngo, a 25-year-old Vietnamese man posing as a Singaporean private detective but actually selling data on to identity thieves.

Now exactly what Experian does to safeguard that information – and how it differs from the company’s credit report databases – is under the microscope. “What are the differences in security measures that would allow hackers to access the information of T-Mobile customers but not the main credit report files?” asked the PIRG letter. “If there are differences, why weren’t the security measures used for the T-Mobile server? If there are no such differences, doesn’t this raise the troubling possibility that the servers holding highly sensitive credit and personal information of over 200 million Americans is vulnerable to a data hack by identity thieves?”

An Experian spokesman said: “Experian understands the concerns raised and we are prepared to respond promptly to requests from regulatory agencies for more details about the incident. Security is a top priority for the company, and Experian is committed to continuous investments in upgrading talent, processes, and technologies needed to protect our systems. Specifically, we made incremental investments of tens of millions of dollars in the last three years alone to strengthen our security positions.”