The Equifax breach (2017)

What happened

In September 2017, Equifax, one of the three major US consumer credit reporting agencies, announced that attackers had accessed personal data on a huge number of people. The final count was about 147 million people, mostly in the United States, with smaller numbers in the UK and Canada.

The stolen data included names, Social Security numbers, birth dates, addresses and, in some cases, driver's license numbers. Credit card numbers for roughly 209,000 people and dispute documents with personal information for others were also taken. Because Social Security numbers and birth dates are used to verify identity and cannot easily be changed, the breach created long-term identity theft risk.

How it worked

The attackers entered through a public website Equifax used for consumers to dispute items on their credit reports. That site used Apache Struts, a popular open-source framework for building Java web applications.

• A known, patched flaw. In March 2017 the Apache Struts project disclosed a serious vulnerability (CVE-2017-5638) that allowed remote code execution through a specially crafted request, and released a fix. Attackers began exploiting it within days. Equifax's internal alert to patch did not result in the vulnerable system being fixed.
• Intrusion from mid-May. Attackers got in around May 2017 and stayed for about 76 days, according to later government reports.
• Moving inside and finding credentials. Once inside, they found stored usernames and passwords that let them query many databases.
• An expired certificate hid the theft. Equifax used a device to inspect encrypted network traffic for signs of data theft, but a digital certificate it relied on had expired months earlier, so the traffic was not being inspected. When staff renewed the certificate on July 29, 2017, they quickly noticed suspicious traffic and began the response.

Impact

The company disclosed the breach on September 7, 2017. Its response was widely criticized, including a confusing breach-check website and early terms that appeared to limit customers' legal rights. Several senior executives, including the chief executive, left the company. In July 2019, Equifax agreed to a settlement with the US Federal Trade Commission, the Consumer Financial Protection Bureau and US states that included up to $700 million, much of it for consumer compensation and credit monitoring.

What defenders learned

• Patch management is a core security control. A fix existed two months before the intrusion. Organizations need an accurate inventory of software and a process that confirms patches are actually applied.
• Certificates and security tools need maintenance. A monitoring tool with an expired certificate is not monitoring anything.
• Segment and limit access. Credentials stored in plain text and broad database access let a single foothold reach far too much data.
• Response quality affects trust. Clear, fast and honest communication matters as much as the technical fix.

What it means for you

In the US, the most effective protection against new-account identity theft is a credit freeze, which has been free at all three bureaus (Equifax, Experian and TransUnion) since a 2018 federal law. A freeze stops lenders from opening new credit in your name. You can lift it temporarily when you apply for credit.

• Freeze your credit at all three bureaus, and for your children too.
• Check your credit reports regularly through the official free annual report service.
• Watch for tax-related identity theft and consider an IRS Identity Protection PIN.
• Be skeptical of calls and emails that quote your personal details, since breached data makes scams more convincing.