Equifax: the update that was not installed

The story

Equifax is one of the three main US credit bureaus, holding financial details on most American adults. On March 7, 2017, a critical flaw was announced in Apache Struts, free software used to build websites, along with a fix. Within days, attackers were scanning the internet for websites that had not installed it.

Equifax had a website for handling disputes that used the software. It was not updated. Attackers got in through it in May and stayed for about 76 days, reaching databases with names, Social Security numbers, birth dates and addresses. The records of about 147 million Americans were taken, along with records of people in the UK and Canada.

An internal review two years earlier had already found that the company was not keeping to its own patching schedule and did not have a complete list of its systems. The breach was found at the end of July and announced in September.

Why it mattered

It was one of the biggest data breaches in history, and the data taken, including Social Security numbers, cannot simply be replaced. The chief executive retired within weeks, and in 2019 Equifax agreed to a settlement with federal regulators and 48 states that included a fund for victims and required changes to prevent another breach.

The lesson today

The fix existed. The problem was knowing which systems needed it, and confirming it went on. You cannot update what you do not know you have. A current list of systems and software, and checks that updates were applied, are the dull basics behind most good security.