Equifax 2017: the data breach that exposed 147 million Americans and then mishandled the response

The breach

On July 29, 2017, Equifax discovered unusual network activity. Internal investigation determined that attackers had been inside Equifax's systems since approximately mid-May. The attackers exploited a vulnerability in Apache Struts (CVE-2017-5638), an open-source web framework. A patch for the vulnerability had been released in March 2017, approximately five months before the exploit. Equifax had not applied the patch to all affected systems.

Between mid-May and late July, the attackers exfiltrated personally identifiable information for approximately 147 million Americans. The data included names, Social Security numbers, birth dates, addresses, driver license numbers, and in some cases credit-card numbers. The scale was catastrophic — roughly 56% of US adults had their SSNs and identity-verification data exposed.

The disclosure delay and response failures

Equifax publicly disclosed the breach on September 7, 2017 — about 40 days after internal discovery. The delay itself was controversial. More problematic, multiple Equifax executives (CFO John Gamble and three other senior executives) sold approximately $1.8 million in Equifax stock between the internal discovery date (July 29) and the public disclosure (September 7). The executives later claimed they had been unaware of the breach when they sold. The SEC and DOJ investigated.

The credit-monitoring sign-up site Equifax launched alongside the disclosure (equifaxsecurity2017.com) was technically broken on multiple levels:

• The site initially included an arbitration clause in the terms of service that appeared to waive consumers' right to sue Equifax. After public backlash, Equifax removed the clause.
• The site's URL was so close to the actual Equifax site that scam-detection tools (and Equifax's own Twitter account in one notable incident) flagged it as suspicious. The Twitter incident, where Equifax directed customers to a phishing site impersonating its breach-response page, became a viral example of bad incident response.
• The site's identity-verification PIN system used birth date and last 4 of SSN — precisely the data the breach had exposed. Customers checking whether their data had been exposed had to provide some of the same data the attackers already had.
• Customer-service phone lines were overwhelmed for weeks. Affected customers couldn't get through to confirm whether their data had been exposed.

Subsequent investigations and settlements

The CEO Richard Smith retired in late September 2017 after the breach response had become a sustained public crisis. The two senior executives directly responsible for security (Chief Security Officer and Chief Information Officer) also departed.

Multiple investigations followed: SEC and DOJ on the executive stock sales, FTC on consumer-protection violations, CFPB on credit-reporting issues, multiple state attorneys general on identity-theft and consumer-protection issues. Equifax settled with the FTC, CFPB, and state attorneys general in July 2019 for $575-700 million depending on participation in consumer claim filings. Total breach-related settlements, fines, and remediation costs exceeded $1.4 billion across the years following the incident.

Equifax's reputation has been damaged for years. The credit-bureau category overall has faced increasing regulatory scrutiny following the breach. Subsequent data-protection regulations (California's CCPA, various state laws) have been partially shaped by the Equifax failure.

How RGM thinks about breach-response readiness

When clients ask about breach-response preparation, the Equifax case is a widely cited cautionary example. The structural failure modes were preventable: a known vulnerability with available patch, delayed disclosure, executive stock sales between discovery and disclosure, broken sign-up site, customer-data-as-verification-input that the breach had already exposed.

The honest framework: breach-response readiness requires pre-built operational infrastructure — patch-management discipline (so available patches actually get applied), executive stock-trading policies that prevent the appearance of insider trading during incident windows, customer-facing response sites that are tested under load and don't reuse breach-exposed data for verification, and CEO crisis-communications training that includes congressional testimony preparation. Equifax had effectively none of these. We tell clients that breach-response infrastructure must be built before incidents happen — building during a crisis produces failures like Equifax's.

Frequently asked questions

Related