incident · 1504742400000

Equifax Data Breach

A massive data breach at credit reporting agency Equifax, exposing sensitive personal information of millions.

What happened

Attackers exploited a known vulnerability in Apache Struts to gain access to Equifax's network, exfiltrating data over several months.

Technical mechanism

Exploitation of CVE-2017-5638 in Apache Struts, followed by lateral movement and data exfiltration.

Why it matters

One of the largest known data breaches, highlighting severe failures in corporate security practices.

Impact

Exposed the personal data (including SSNs) of approximately 147 million people, leading to significant financial and reputational damage.

Response

Equifax offered free credit monitoring; congressional hearings and massive settlements followed.

Defensive lessons

  • Crucial need for vulnerability management
  • Importance of network monitoring and egress filtering
  • Need for strong data encryption at rest

Evidence register

  1. U.S. Department of Justice — DOJ Indictment on Equifax Hack (verified)