The 2017 Equifax data breach stands as a significant event in cybersecurity history, impacting over 140 million Americans. This incident, which exploited an unpatched security vulnerability, unfolded over several months before its public disclosure. The timeline of its discovery, the subsequent announcement, and the immediate reactions from both the financial markets and the public offer a critical look into the rapid consequences of such a large-scale
cyberattack.
The Intrusion and Discovery Phase
The data breach at Equifax began on May 12, 2017. At this time, Equifax had not yet updated its credit dispute website with the latest version of Apache Struts, a web application framework. This oversight created a critical vulnerability that hackers were quick to exploit. The attackers gained access to internal servers within Equifax's corporate network, initially obtaining internal credentials for employees.
With these credentials, the hackers were able to access and query credit monitoring databases, appearing as authorized users. To further mask their activities, they used encryption during their searches. Over a period of 76 days, the hackers performed more than 9,000 scans of the databases, extracting information into small temporary archives. These archives were then exfiltrated from Equifax servers, and subsequently deleted, all to evade detection. The intrusion continued undetected until July 29, 2017, when Equifax finally discovered the breach.
Public Disclosure and Market Reaction
Following the discovery, Equifax disclosed the breach and its extensive scope on September 7, 2017. By this time, the company had already shut down the exploit on July 30. The disclosure revealed that the breach affected over 140 million Americans, a number that VentureBeat characterized as making it "one of the biggest data breaches in history." The financial markets reacted swiftly and negatively to this news.
Equifax shares experienced a significant drop, falling 13% in early trading the day after the breach was made public. This immediate market response underscored the severity of the incident and the potential financial repercussions for the company. The public, upon learning of the breach, was advised by numerous media outlets to take protective measures, most notably to request a credit freeze, in an effort to mitigate the potential impact of their compromised personal information.
Underlying Security Weaknesses
While the failure to update Apache Struts was a primary point of vulnerability, analysis of the breach identified several additional security weaknesses that contributed to the incident's scale. These included an insecure network design that lacked sufficient segmentation, which could have limited the hackers' lateral movement within the network. Furthermore, there was potentially inadequate encryption of personally identifiable information (PII), leaving sensitive data more exposed.
Another critical factor was the presence of ineffective breach detection mechanisms. The fact that the intrusion went undetected for 76 days highlights a significant lapse in Equifax's ability to identify and respond to ongoing cyberattacks. These combined weaknesses allowed the perpetrators to maintain access and exfiltrate a vast amount of data over an extended period, complicating efforts to track them, especially given that at least 34 servers in 20 different countries were used at various points during the breach.
