--- title: Equifax 2017: the data breach that exposed 147 million Americans and then mishandled the response | RGM® url: https://realgrowthmatters.com/learn/case-studies/equifax-2017-data-breach-cautionary/ updated: 2026-06-10 source_html: https://realgrowthmatters.com/learn/case-studies/equifax-2017-data-breach-cautionary/ --- - **Story:** On July 29, 2017, Equifax discovered unauthorized intrusion. By September 7 public disclosure, ~147M Americans' data was exposed. Root cause: unpatched Apache Struts vulnerability with patch available 5 months earlier. Response failures included broken sign-up site, executive stock sales, delayed disclosure. Settlements exceeded $700M. - **Why it matters:** Equifax 2017 is the defining data-breach response failure. Multiple layers of preventable failure (unpatched vulnerability, delayed disclosure, broken response site, executive stock sales) compounded. - **Takeaway:** Pre-built breach-response infrastructure must exist before incidents happen. - **Takeaway:** Patch-management discipline is preventive incident response. - **Takeaway:** Executive stock-trading policies must prevent the appearance of insider trading during incident windows. ## Equifax 2017 — the four-step story S Situation Equifax had a known Apache Struts vulnerability On July 29, 2017, Equifax discovered unauthorized intrusion. By September 7 public disclosure, ~147M Americans' data was exposed. Root cause: unpatched Apache Struts vulnerability with patch available T Task Apply available patch before exploitation Equifax 2017 is the defining data-breach response failure. Multiple layers of preventable failure (unpatched vulnerability, delayed disclosure, broken response site, executive stock sales) compounded A Action Failed to patch; attackers exploited the vulnerability Pre-built breach-response infrastructure must exist before incidents happen. R Result 147M records exposed, $700M+ settlements, lasting reputation damage Patch-management discipline is preventive incident response. ## Equifax breach at a glance ~0M Americans exposed ~56% of US adults Source: Equifax disclosures 0 days Discovery to public disclosure July 29 to September 7, 2017 Source: Public timeline 0 months Patch available before breach Apache Struts patch March 2017 Source: Apache release records $0M Executive stock sold Between discovery and disclosure Source: SEC filings $0M+ FTC + CFPB + state settlements July 2019 settlement Source: FTC enforcement action 0 Vulnerability exploited CVE-2017-5638 Source: CVE database #### Quick facts CompanyEquifax Inc. (NYSE: EFX) Breach discovered internallyJuly 29, 2017 Public disclosureSeptember 7, 2017 Records exposed~147M Americans (~56% of US adults) Data exposedNames, SSNs, birth dates, addresses, driver license numbers, credit card numbers (some) Root causeUnpatched Apache Struts vulnerability (CVE-2017-5638) Patch availability before breachMarch 2017 (~5 months before breach) Cumulative settlement$700M+ across consumer settlements, FTC fines, CFPB penalties, state actions **Honest note** The Equifax 2017 breach is one of the most-documented corporate data breaches in modern history. The technical facts (Apache Struts vulnerability, patch available 5 months before exploit) are uncontested. The response failures (sign-up site issues, executive stock sales, congressional testimony delays) are also extensively documented. The case is taught in cybersecurity and crisis-comms curricula as a multi-layered failure. ## The breach On July 29, 2017, Equifax discovered unusual network activity. Internal investigation determined that attackers had been inside Equifax's systems since approximately mid-May. The attackers exploited a vulnerability in Apache Struts (CVE-2017-5638), an open-source web framework. A patch for the vulnerability had been released in March 2017, approximately five months before the exploit. Equifax had not applied the patch to all affected systems. Between mid-May and late July, the attackers exfiltrated personally identifiable information for approximately 147 million Americans. The data included names, Social Security numbers, birth dates, addresses, driver license numbers, and in some cases credit-card numbers. The scale was catastrophic — roughly 56% of US adults had their SSNs and identity-verification data exposed. ## The disclosure delay and response failures Equifax publicly disclosed the breach on September 7, 2017 — about 40 days after internal discovery. The delay itself was controversial. More problematic, multiple Equifax executives (CFO John Gamble and three other senior executives) sold approximately $1.8 million in Equifax stock between the internal discovery date (July 29) and the public disclosure (September 7). The executives later claimed they had been unaware of the breach when they sold. The SEC and DOJ investigated. The credit-monitoring sign-up site Equifax launched alongside the disclosure (equifaxsecurity2017.com) was technically broken on multiple levels: - **The site initially included an arbitration clause** in the terms of service that appeared to waive consumers' right to sue Equifax. After public backlash, Equifax removed the clause. - **The site's URL was so close to the actual Equifax site** that scam-detection tools (and Equifax's own Twitter account in one notable incident) flagged it as suspicious. The Twitter incident, where Equifax directed customers to a phishing site impersonating its breach-response page, became a viral example of bad incident response. - **The site's identity-verification PIN system used birth date and last 4 of SSN** — precisely the data the breach had exposed. Customers checking whether their data had been exposed had to provide some of the same data the attackers already had. - **Customer-service phone lines were overwhelmed** for weeks. Affected customers couldn't get through to confirm whether their data had been exposed. ## Subsequent investigations and settlements The CEO Richard Smith retired in late September 2017 after the breach response had become a sustained public crisis. The two senior executives directly responsible for security (Chief Security Officer and Chief Information Officer) also departed. Multiple investigations followed: SEC and DOJ on the executive stock sales, FTC on consumer-protection violations, CFPB on credit-reporting issues, multiple state attorneys general on identity-theft and consumer-protection issues. Equifax settled with the FTC, CFPB, and state attorneys general in July 2019 for $575-700 million depending on participation in consumer claim filings. Total breach-related settlements, fines, and remediation costs exceeded $1.4 billion across the years following the incident. Equifax's reputation has been damaged for years. The credit-bureau category overall has faced increasing regulatory scrutiny following the breach. Subsequent data-protection regulations (California's CCPA, various state laws) have been partially shaped by the Equifax failure. ## How RGM thinks about breach-response readiness When clients ask about breach-response preparation, the Equifax case is a widely cited cautionary example. The structural failure modes were preventable: a known vulnerability with available patch, delayed disclosure, executive stock sales between discovery and disclosure, broken sign-up site, customer-data-as-verification-input that the breach had already exposed. The honest framework: breach-response readiness requires pre-built operational infrastructure — patch-management discipline (so available patches actually get applied), executive stock-trading policies that prevent the appearance of insider trading during incident windows, customer-facing response sites that are tested under load and don't reuse breach-exposed data for verification, and CEO crisis-communications training that includes congressional testimony preparation. Equifax had effectively none of these. We tell clients that breach-response infrastructure must be built before incidents happen — building during a crisis produces failures like Equifax's. ## Frequently asked questions How many people were actually affected? Approximately 147 million Americans (about 56% of US adults). The figure includes anyone whose personally identifiable information was exposed, which for the Equifax credit-bureau database includes essentially anyone who has ever had a US credit account. What was the Apache Struts vulnerability? CVE-2017-5638, a remote-code-execution vulnerability in Apache Struts (a Java web framework). The vulnerability was disclosed publicly in March 2017 and a patch was released the same day. The exploit was straightforward — an attacker could send a malicious HTTP header to a vulnerable Struts server and execute arbitrary code. Equifax did not apply the patch to all affected systems before the attackers exploited it in mid-May 2017. Did the executives who sold stock face prosecution? Mostly no. The SEC investigated but didn't bring formal charges against most of the executives. One Equifax employee (a senior software engineer, not one of the senior executives) was prosecuted for insider trading on a smaller stock sale. The executives' claim that they had been unaware of the breach when they sold was not formally disproven, though the timing remains widely seen as suspicious. ### Sources & references - [Equifax 2017 data breach (Wikipedia)](https://en.wikipedia.org/wiki/2017_Equifax_data_breach) — Historical reference with detailed timeline. - [FTC settlement](https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement) — FTC consumer-protection enforcement action. - [House Oversight Committee report](https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf) — Congressional investigation findings. ## Related [#### All case studies The full case-study library.](/learn/case-studies/)[#### Wells Fargo fake accounts Adjacent corporate-failure cautionary case.](/learn/case-studies/wells-fargo-fake-accounts-scandal/)[#### United Dr. Dao Crisis response cautionary case from same era.](/learn/case-studies/united-airlines-dao-crisis-2017/)[#### Tylenol 1982 Crisis response done right, in contrast.](/learn/case-studies/tylenol-1982-crisis-response/)