How Equifax ignored one patch and exposed 147 million people

On July 29, 2017, an Equifax security analyst noticed suspicious traffic leaving the network. What the investigation revealed over the following hours was alarming: hackers had been inside the company's systems for 76 days, quietly sweeping databases holding personal information on half of the adult population of the United States. The way in? A patch that had been available for months and simply was never applied.

A known vulnerability, ignored for months

On March 7, 2017, the Apache Software Foundation publicly disclosed CVE-2017-5638, a critical flaw in the Apache Struts framework that allows unauthenticated remote code execution. The patch was released the same day. Two days later, on March 9, Equifax's security team sent an internal notice instructing teams to apply the fix urgently.

The notice was ignored. The ACIS system — the web application Equifax used so consumers could dispute information in their credit reports — kept running the vulnerable version of Apache Struts for two more months.

On May 13, 2017, the attackers walked in.

How the intruders operated for 76 days without being detected

Once inside the ACIS system, the attackers found something that made their work far easier: administrator credentials stored in plain text in a file accessible on the network. With those credentials they moved laterally into other systems that Equifax had not properly segmented.

Equifax also had no robust traffic monitoring on its legacy databases. Worse, the SSL certificate used to inspect internal traffic had been expired for 19 months — which meant the attackers' encrypted traffic passed through without inspection.

The intruders ran more than 9,000 queries against 51 distinct database tables during the 76 days of access, exfiltrating data in small batches to avoid raising alerts. When the security team finally detected the anomalous traffic on July 29, the attackers had already been gone for a day.

What exactly was exposed in the Equifax breach?

147 million records were compromised, including: full names, Social Security numbers, dates of birth, addresses and, in many cases, driver's license numbers. Around 209,000 credit card numbers were also stolen, along with credit dispute documents belonging to roughly 182,000 people.

Beyond Americans, consumers in the United Kingdom and Canada were also affected — 15 million and 19,000 records, respectively. Equifax only disclosed the incident publicly on September 7, 2017, more than five weeks after discovery.

The chain of failures the US Senate documented

The US Senate report, published in 2019, catalogued the failures in layers. It was not a single act of negligence — it was a system of oversights that reinforced one another:

• Broken patch process: the March notice went out, but there was no compliance verification. Nobody confirmed the patch had been applied.
• No network segmentation: the initial compromise of one system granted access to dozens of others, because the networks were not isolated.
• No monitoring on legacy systems: ACIS was an old system with inadequate logging.
• Plain-text credentials: administrator passwords accessible without encryption inside the internal network.
• TLS certificate expired for 19 months: made inspection of internal encrypted traffic impossible.

In isolation, each of these failures would be serious. Combined, they made detection nearly impossible for more than two months.

The US$700 million settlement and what changed

In July 2019, Equifax reached a settlement with the FTC, the CFPB and the attorneys general of all 50 US states. The total came to US$700 million — at the time, one of the largest data breach settlements in history. Of that, US$425 million went to a compensation fund for affected consumers, US$175 million to the states and US$100 million as a fine to the CFPB.

CEO Richard Smith resigned days after the breach was made public. The CIO and CSO left as well. Equifax was required to implement a comprehensive information security program and to undergo third-party audits for years.

In practice, the impact for individual consumers was limited: most received a few years of free credit monitoring. The stolen data — Social Security numbers, dates of birth, addresses — is permanent and immutable. There is no way to "swap out" your Social Security number after it has been exposed.

The lesson Equifax left for the industry

CVE-2017-5638 was not an unknown zero-day vulnerability. It was a public flaw, with a patch available, that had been widely reported by Bleeping Computer, The Register and other specialist outlets. The exploit that brought down Equifax used exactly the proof-of-concept published by the security community itself to demonstrate how serious the flaw was.

That makes the Equifax case different from incidents like WannaCry, which used an NSA exploit leaked by the Shadow Brokers, or NotPetya, which was a state attack disguised as ransomware. At Equifax there was no exceptional sophistication on the adversary's part — there was a basic process failure.

The question the case raises for any organization is direct: if a critical patch is disclosed tomorrow, can you verify within 48 hours that every affected system has been fixed? Equifax could not. And 147 million people paid for it.

The same kind of failure — outdated third-party code in production — was at the center of Heartbleed in 2014, when the OpenSSL vulnerability sat in the code for two years before being discovered. Third-party libraries and frameworks create invisible attack surfaces that only show up when someone checks.

If you look after infrastructure or development, it's worth reviewing right now: which frameworks and dependencies are running in production at your organization, and what is the actual process for making sure critical patches get applied — not just announced?