2017Data breachVulnerability exploitation
Equifax data breach
May to July 2017
Attackers exploited a known vulnerability in the Apache Struts web framework (CVE-2017-5638) on Equifax's online dispute portal, months after a fix was released, and spent weeks querying databases holding consumer data. In 2019 Equifax agreed a settlement with the FTC, the CFPB and US states.
- Victim
- Equifax and US consumers
- Sector
- Financial services (credit reporting)
- Public attribution
- In 2020 the US Department of Justice charged four members of China's People's Liberation Army over the breach.
Impact
The FTC said the breach affected approximately 147 million people, and the settlement was at least 575 million US dollars and potentially up to 700 million.
Root cause
An unpatched, internet-facing application, weaknesses in detection and segmentation of database access, and poor data governance, according to the GAO's summary of Equifax's own investigation.
Lessons learned: the controls it teaches
- Maintain an accurate asset inventory so every vulnerable system gets patched.
- Segment databases and limit what a compromised web application can query.
- Make sure monitoring tools work, including certificates for inspection devices.
Related exams
Sources
- GAO-18-559: Data Protection: Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach
- FTC: Equifax to pay $575 million as part of settlement with FTC, CFPB, and states related to 2017 data breach
- NVD: CVE-2017-5638 (Apache Struts)
- US Department of Justice: Chinese military personnel charged with computer fraud, economic espionage and wire fraud for hacking into Equifax