The 2017 Equifax Breach: An Unpatched Server and 147 Million People
Equifax lost data on about 147 million people in 2017 after missing a patch for Apache Struts. See the timeline, the expired certificate and the lessons.
In September 2017, the US credit reporting company Equifax announced that attackers had stolen personal information about roughly 147 million people. Credit bureaus hold exactly the data identity thieves want, so the breach attracted intense attention from Congress, regulators and the public. The cause was not exotic. A known flaw in a web application framework had not been fixed on one of the company's systems.
What was stolen
Equifax said the attackers obtained names, Social Security numbers, birth dates and addresses for most of the affected consumers, and driver's licence numbers for some. About 209,000 credit card numbers and certain dispute documents were also taken. The company also reported that people in the United Kingdom and Canada were affected, though in smaller numbers.
The vulnerability
The entry point was a flaw in Apache Struts, a popular open-source framework for building Java web applications. The vulnerability, CVE-2017-5638, was disclosed on 7 March 2017, and a fixed version was released the same day. The weakness allowed an attacker to run commands on a server by sending a crafted request. It was serious, and security advisories said that exploitation had begun within a very short time.
A US government security notice went to Equifax in early March, but the vulnerable system, an online dispute portal, was not patched. According to a US congressional report, the scan that was meant to find vulnerable systems did not detect it.
The timeline
| Date (2017) | Event |
|---|---|
| 7 March | Struts flaw disclosed and patched by the maintainers |
| Mid-May | Attackers gain access to Equifax's dispute portal |
| Mid-May to late July | Attackers move around the network and take data |
| 29 July | Equifax's security team notices suspicious traffic |
| 7 September | The company announces the breach publicly |
The expired certificate
One of the most striking findings in the House Oversight committee's report was that a tool meant to inspect encrypted network traffic had been running with an expired digital certificate for around 19 months. Because of that, the company could not see data leaving its network in encrypted form. When the certificate was finally renewed in late July, the team noticed suspicious activity almost straight away. It is a vivid example of how a forgotten renewal can blind a security system.
Consequences
Equifax's chief executive, Richard Smith, left the company in September 2017, and other executives departed. In July 2019, Equifax agreed a settlement with the US Federal Trade Commission, the Consumer Financial Protection Bureau and state authorities that would provide at least 575 million US dollars and potentially up to 700 million, including funds for consumer compensation and credit monitoring. The UK's data protection regulator also issued a fine, the maximum available at the time under the old law, for the British data involved.
What failed
- Patch management. The company did not know about, or did not fix, a vulnerable system quickly enough.
- Asset inventory. If you do not know which servers run which software, you cannot patch them.
- Certificate monitoring. An expired certificate disabled a defence for more than a year.
- Segmentation. The attackers were able to move from the portal to databases containing sensitive data.
After the breach: what individuals were told
Equifax's handling of the aftermath drew criticism too. The website set up to check whether a person was affected was criticised for confusing results and terms of service, and the company's social media account was reported to have posted a link to a lookalike website by mistake. Some consumers placed credit freezes on their files, a step that makes it harder for criminals to open accounts in their name, and the incident helped make freezes free of charge in the United States under a law passed in 2018.
For smaller businesses, there is a communication lesson: set up a clear notice on your own domain, avoid sending customers to unfamiliar addresses and explain plainly what happened and what people can do. Trust is easier to keep when your explanation is quick and specific.
Open-source components are your responsibility
The flaw was not Equifax's own code but a component it relied on. That is true of nearly every modern website: WordPress plugins, JavaScript libraries and PHP packages are all built from other people's code. When a vulnerability is announced in one of them, the maintainers publish a fix, but nobody applies it for you unless you set up the process. A short list of the components you use, and a subscription to their security announcements, makes the difference between a quick patch and a long breach.
The practical lesson for site owners
Know what software your site and server run, including the frameworks and libraries underneath, and have a routine for applying security releases within days. Set reminders or use automatic renewal for all certificates so that none expires unnoticed. Keep sensitive data in separate systems from the public-facing parts of your site.
Free certificates that renew automatically take one task off the list; see our SSL page for how this works with our hosting, and read our security overview for related protections.
