Between May 12 and July 30, 2017, attackers exploited a critical Apache Struts vulnerability in Equifax’s online credit-dispute website after the company failed to install a security patch released on March 7. The intrusion went undetected for 76 days, in part because an SSL certificate used to inspect network traffic had expired for nine months. Attackers used employee credentials to conduct more than 9,000 database queries and extracted names, addresses, birth dates, Social Security numbers, driver’s-license data, credit-card numbers, and dispute documents. Equifax ultimately reported that 147.9 million Americans, 15.2 million British citizens, and about 19,000 Canadians were affected.
The breach exposed broader governance failures documented in a 2015 internal audit, including an unresolved vulnerability backlog, incomplete asset inventories, weak patch enforcement, default administrative credentials, absent two-factor authentication, poor network segmentation, and ineffective detection. Equifax disclosed the incident on September 7, 2017, more than a month after discovery; CEO Richard Smith retired on September 26, while three executives sold nearly $1.8 million in shares shortly after discovery, prompting a Justice Department insider-trading investigation. On July 22, 2019, Equifax agreed to a settlement with the FTC, CFPB, 48 states, Washington, D.C., and Puerto Rico involving $300 million for consumer compensation, $175 million for states and territories, and $100 million in CFPB penalties. The UK Financial Conduct Authority separately imposed an £11,164,400 penalty. The U.S. Justice Department indicted four Chinese military personnel on February 10, 2020; China denied involvement.
