Equifax data breach

On 7 September 2017, the U.S. credit bureau Equifax disclosed that attackers had exfiltrated personal information on roughly 148 million consumers — nearly half the adult population of the United States — over a 76-day intrusion that began with a single unpatched Apache Struts server.

What happened

In March 2017, the Apache Software Foundation published CVE-2017-5638, a remote code execution flaw in Apache Struts 2. Equifax's internal security team was notified within 48 hours but did not patch the consumer-dispute portal (onlinedisputes.equifax.com) that ran on it. On 13 May 2017, attackers exploited the unpatched flaw, planted webshells, and began running database queries.

Over 76 days, the intruders executed more than 9,000 queries against Equifax's internal databases, exfiltrating data in small enough chunks to avoid attention. They were aided by a lapsed TLS certificate on an internal network-monitoring appliance — once it expired, Equifax could not decrypt and inspect outbound traffic, blinding it to the exfiltration in progress.

Detection came almost by accident on 29 July 2017 when an administrator renewed the certificate. Within 24 hours, Equifax saw the queries and began incident response.

Impact

• 147.9 million people in the U.S., 15.2 million in the U.K., and 8,000+ in Canada had names, Social Security numbers, dates of birth, addresses, and (for a subset) driver's license numbers exposed.
• For 209,000 people, credit card numbers were also stolen.
• Equifax's reported total cost: over $1.38 billion, including the $700 million FTC + state attorney general settlement in 2019.
• The CEO, CIO, and CISO all resigned within weeks; the U.S. House Oversight Committee's post-mortem report concluded the breach was "entirely preventable."

Attribution

In February 2020, the U.S. Department of Justice unsealed indictments against four members of the Chinese People's Liberation Army's 54th Research Institute. The DOJ assessed that the operation was a state-sponsored intelligence collection effort against the U.S. credit bureau, not financially-motivated criminal activity. None of the indicted personnel were extradited.

Why it matters

Equifax remains the canonical case for vulnerability-management failure at scale: a single un-patched perimeter system, a months-long dwell time, and a monitoring blind spot turned a known fix into the largest U.S. PII breach of the decade. It also reshaped U.S. regulatory expectations — the NYDFS Cybersecurity Regulation and subsequent state laws explicitly require timely patching of known critical vulnerabilities on internet-facing systems, with Equifax's timeline as the negative example in every training deck.