> series: anatomy_of_a_breach —— part: 105 —— target: equifax —— americans: 147,000,000 —— vulnerability: apache_struts —— patch_delay: 2_months<span class="cursor-blink">_</span>_
On 7 September 2017, Equifax disclosed that attackers had accessed the personal data of approximately 147 million Americans — nearly half the US population — through its consumer dispute resolution portal. The stolen data included names, Social Security numbers, dates of birth, addresses, and in some cases driver's licence numbers and credit card numbers. The breach had been active from May to July 2017 — 78 days of undetected access to the most sensitive financial data in the country.
The attack exploited CVE-2017-5638, a critical remote code execution vulnerability in Apache Struts — the web application framework powering Equifax's dispute portal. The vulnerability had been publicly disclosed and patched on 6 March 2017. Equifax did not apply the patch. The attackers exploited it two months later, in May 2017 — the same month WannaCry struck. Equifax's CEO, CIO, and CSO all departed. The company ultimately agreed to a $700 million settlement with the FTC — the largest data breach settlement in US history at the time.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallCVE-2017-5638 was disclosed and patched on 6 March 2017. Equifax was breached in May. Under Cyber Essentials Danzell's 14-day patching mandate, the vulnerability should have been patched by 20 March — two months before the attackers exploited it. The Equifax breach, like WannaCry (59 days) and Sony PSN (known vulnerabilities), was a patching failure — a known vulnerability, with an available patch, not applied in time.
Equifax was not just any company — it was a credit reporting agency that citizens were effectively required to provide their most sensitive data to (through credit applications, employment checks, and financial services). The breach raised fundamental questions about the security obligations of organisations that hold data not by customer choice but by systemic necessity. The OPM breach (2015) raised similar questions about government data custodians.
For UK organisations, the Equifax breach reinforced every lesson of this nine-year series: patch promptly (Cyber Essentials Danzell — 14 days), encrypt sensitive data at rest, monitor continuously (SOC in a Box), and maintain incident response capability (UK Cyber Defence). Our web application testing identifies the Apache Struts, Spring, and other framework vulnerabilities that the Equifax attackers exploited. Because if a credit bureau cannot protect 147 million Social Security numbers, no organisation can assume its data is safe without tested, verified controls.
<a href="/vulnerability-scanning">Vulnerability scanning</a> finds missing patches. <a href="/penetration-testing/web-application">Web application testing</a> identifies framework vulnerabilities. <a href="/cyber-essentials">Cyber Essentials</a> mandates 14-day patching.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call