Forget the SEC and the FTC — the Department of Justice wants to get in some licks on the Equifax scandal, and their licks could carry prison time. Bloomberg reports today that a US Attorney out of Atlanta has opened a criminal insider-trading probe involving three major figures within the company, where hackers gained access to the data for 143 million Americans. The probe raises the stakes for Equifax, and perhaps for Congress, too:

The U.S. Justice Department has opened a criminal investigation into whether top officials at Equifax Inc. violated insider trading laws when they sold stock before the company disclosed that it had been hacked, according to people familiar with the investigation.

Prosecutors are looking at the stock sales by Equifax Chief Financial Officer John Gamble; President of U.S. Information Solutions Joseph Loughran; and President of Workforce Solutions Rodolfo Ploder, said two people, who asked not to be named because the probe is confidential. …

Equifax disclosed earlier this month that it discovered a security breach on July 29. The three executives sold shares worth almost $1.8 million in early August. The company has said the managers didn’t know of the breach at the time they sold the shares.

The SEC and FTC investigations could have resulted in serious fines, trading disqualifications, and so on, but not prison time; they only have the power to levy civil penalties. A criminal investigation could very well produce prison sentences, especially in major scandals like this. That assumes that the DoJ has a reasonable suspicion of criminal activity in this case, of course, rather than opening a probe out of an abundance of caution and recognition of the politics surrounding this case.

If it’s only the latter, it could needlessly complicate matters for all of the other investigations, as the criminal probe has to take precedence — and potential witnesses might be reluctant to talk with regulators while the threat of prosecution hangs over their heads. They’ll be doubly reluctant to answer questions in public from congressional committees in ways that could incriminate them later. This might end up delaying the public accounting for the Equifax scandal, although that delay might be preferable to letting people off the hook with just a public scolding.

Even if there’s significant reasonable suspicion of insider trading, criminal charges will not be easy to prove. In order to succeed in an insider-trading prosecution, the DoJ will have to prove that these executives (a) knew about the hack and the impact it would have on stock prices when disclosed, and (b) acted primarily on that information before it got out to the public and other investors. They certainly did sell their stock before Equifax announced the hack, but the company insisted last week that the three executives involved were not in the loop. It’s hard to believe that the CFO and the head of IT at a major corporation would not have been immediately informed of a hack this massive, but … the prosecution will have to prove they knew it for a conviction.

The other question might be whether these sales fit an established pattern of normal profit-taking for these execs. Do they sell on a regular basis, and did they sell all or most of their holdings? The amount involved, less than $2 million combined between the three, seems low for an attempt to get out ahead of the news of the hack, but perhaps that was their total exposure — or perhaps all the stock they could legally sell.

The discovery process in this probe will be interesting indeed. We may find out more about the nature of the hack, the preparation Equifax did or did not have in place, warnings heeded and warnings ignored, and so on as prosecutors peruse internal communications at Equifax.