Equifax Data Breach

The Equifax data breach was one of the most consequential cybersecurity failures of the 2010s, exposing the sensitive personal information of nearly half the United States population. The intrusion exploited a known, patchable flaw in Apache Struts, a widely used open-source web application framework.

The Vulnerability

The Apache Struts project disclosed a critical remote code execution flaw, CVE-2017-5638, and released a patch on March 7, 2017. Security researchers warned that attackers were actively scanning the internet for unpatched Struts installations within days of disclosure. Equifax failed to apply the patch to a consumer dispute portal running the vulnerable software.

Discovery and Disclosure

According to Equifax's own account and subsequent congressional testimony, attackers gained access to the company's network around mid-May 2017 (reported variously as May 12 or May 13) and moved through internal systems undetected for roughly two months. The intrusion was only discovered on July 29, 2017, after IT staff noticed suspicious network traffic while renewing an expired internal SSL certificate. Equifax did not disclose the breach publicly until September 7, 2017—a delay of more than five weeks that drew sharp criticism, compounded by reports that several executives sold company stock worth roughly $1.8 million in the interval between discovery and disclosure.

Scale of the Breach

Equifax initially reported that approximately 143 million U.S. consumers were affected; that figure was later revised upward to roughly 147.9 million. Exposed data included names, Social Security numbers, birth dates, addresses, and, for a subset of victims, driver's license numbers and credit card numbers. The breach also affected an estimated 15.2 million UK residents and about 19,000 Canadians.

Response and Criticism

Equifax's response drew widespread condemnation: the breach-notification website it set up resembled a phishing page, and its terms initially included an arbitration clause that appeared to limit consumers' ability to sue. Within weeks, the company's Chief Information Officer and Chief Security Officer departed, and CEO Richard Smith retired on September 26, 2017, later testifying before Congress about the failures.

Regulatory and Legal Fallout

In July 2019, Equifax reached a settlement with the U.S. Federal Trade Commission, the Consumer Financial Protection Bureau, and all fifty states, agreeing to pay up to $575 million (rising to $700 million depending on claims), including a $100 million CFPB civil penalty and a consumer restitution fund. The UK's Financial Conduct Authority separately fined Equifax's UK arm £11,164,400 in 2018.

DOJ Indictment

On February 10, 2020, the U.S. Department of Justice announced the indictment of four members of China's People's Liberation Army on nine counts, including conspiracy to commit computer fraud, economic espionage, and wire fraud, alleging they orchestrated the intrusion. Chinese authorities denied any involvement.

Timeline

• 2017-03-07Apache Struts discloses CVE-2017-5638 and releases a patch; attackers begin scanning for unpatched servers within days.
• 2017-05Attackers reportedly begin accessing Equifax's network through the unpatched Apache Struts vulnerability in a consumer dispute portal (reported as mid-May 2017; exact day disputed across sources).
• 2017-07-29Equifax discovers the intrusion after suspicious traffic is noticed during renewal of an expired SSL certificate.
• 2017-09-07Equifax publicly discloses the breach, stating approximately 143 million U.S. consumers were affected.
• 2017-09-15Equifax's Chief Information Officer and Chief Security Officer depart the company.
• 2017-09-26CEO Richard Smith retires amid the fallout.
• 2019-07-22Equifax reaches a settlement of up to $575-700 million with the FTC, CFPB, and U.S. states.
• 2020-02-10U.S. Department of Justice indicts four members of China's People's Liberation Army on nine counts related to the breach.