Equifax Had 48 Hours to Install a Patch. Hackers Arrived Two Months Later and Took Data on 147 Million People

On March 9, 2017, a security team at Equifax sent an email to about 430 people. It described a flaw in a piece of web software called Apache Struts, rated the risk critical, and told anyone running the software to patch it within 48 hours.

Equifax is one of the three big credit bureaus, a company that collects consumer data and sells credit reports. One of its systems was running the flawed software. That system didn't get the patch.

On May 13, attackers got in through that flaw. By the time Equifax took the system offline on July 30, the attackers had taken, by the Federal Trade Commission's later count, no fewer than 147 million names and dates of birth, along with 145.5 million Social Security numbers and 209,000 payment card numbers. The warning had gone out almost five months earlier.

The email that reached 430 people

The flaw had a catalog number, CVE-2017-5638, and a short history. The Apache Struts team first heard about it on February 14, 2017. On March 7 the team released a fix and announced the problem publicly. The next day, the Department of Homeland Security alerted Equifax.

Equifax's threat team passed the alert along on March 9. The email didn't hedge. "As exploits are available for this vulnerability and it is currently being exploited, it is rated at a critical risk and requires patching within 48 hours as per the security policy," it read. A week later, on March 16, the team covered the same flaw at a monthly meeting and emailed the slides to the same 430 people.

Fixing it meant moving to a newer version of Struts. The Apache team also published other options, including a pair of plug-ins on March 20 that closed the hole without a full upgrade. Equifax had a security team, a written patching policy and a deadline. Its privacy policy at the time described "reasonable physical, technical and procedural safeguards" for consumer data. The FTC alleges that what Equifax lacked was a follow-up: the security team ordered the patching and didn't check that the responsible employees carried it out.

The email also reached people who weren't the ones to act on it. Graeme Payne, a senior vice president for the company's corporate platforms, told House investigators that he was copied for information only and had no duty under the patch policy to install anything.

A scan that looked in the wrong place

Equifax did try to find the vulnerable systems. It ran an open-source component scan. On March 15, it also scanned 958 internet-facing addresses twice using a McAfee tool loaded with a new detection rule. Neither scan found a vulnerable copy of Struts.

Russ Ayres, Equifax's interim chief security officer, told House staff why the first scan came up empty: it ran against the root directory instead of the subdirectory where Struts was listed. It was the digital version of checking the lobby for a package left in a back office.

The system that held the flaw was called the Automated Consumer Interview System, or ACIS. Equifax built it in the 1970s to handle disputes. By 2017 it was the place where an ordinary person could go online and say that something in their credit file was wrong. It ran on a legacy setup in a data center in Alpharetta, Georgia, with a door open to the public internet. The place for fixing errors was the way in.

The House report describes ACIS as one of several custom-built legacy systems running Equifax's most important applications. Equifax had started a project to modernize its older systems. The report found that the effort came too late to prevent the breach.

Seventy-six days inside

Mandiant, the firm Equifax hired to investigate, found the first sign of someone using the Struts flaw against Equifax on March 10. The attackers ran a command called "whoami." Mandiant found no direct evidence linking that activity to the attack that began in May.

On May 13, the attackers entered through ACIS. They planted small scripts called web shells, about 30 of them over the course of the attack, which gave them remote control of the servers. Then they found an unsecured file that held administrative usernames and passwords in plain text.

ACIS only needed to reach three databases to do its job. It wasn't walled off from the rest of the network, so the stolen logins opened 48 other databases. The attackers ran about 9,000 queries. Of those, 265 returned personal information. They saved the results into files, compressed them, parked them in a folder reachable from the web and pulled them out with a common file-transfer tool. The House report's count of the whole operation is 76 days. That's 76 days with no alarm.

Equifax also didn't have file integrity monitoring turned on for ACIS. Mandiant found that this kind of monitoring could have caught the web shells when they were created.

The Justice Department's indictment, which came later, adds a few details about how the intruders stayed hidden. It alleges they sent traffic through about 34 servers in nearly 20 countries and deleted their compressed files and wiped their log files every day. The Justice Department's release notes that the details in an indictment are allegations, and that the four people charged, who are alleged to be members of China's military, are presumed innocent unless proven guilty in court.

Caught by a certificate renewal

Equifax did have a tool built to spot this kind of theft. It watched the encrypted traffic flowing in and out of ACIS. The tool needed a valid security certificate to see inside that traffic, and the certificate had expired. For the whole 76 days, the device was effectively looking at sealed envelopes. It wasn't the only one: the House report found that Equifax had allowed more than 300 security certificates to expire, including 79 that covered monitoring of business-critical domains.

On the night of July 29, a team at Equifax uploaded 67 new certificates to the appliance. Suspicious traffic showed up right away, including traffic tied to an address in China. Equifax blocked it. The next day the team spotted more suspicious traffic from a second address, and on July 30 Equifax took ACIS offline.

On August 17, CEO Richard Smith spoke to students at the University of Georgia's business school and boasted that Equifax was managing "almost 1,200 times" the amount of data held in the Library of Congress every day. That was three weeks before the company told the public about the breach.

Equifax announced it on September 7, 2017. The first count was 143 million consumers. A forensic review later added 2.5 million more, and a March 2018 update added another 2.4 million, bringing the figure in the House report to 148 million. The FTC's figure is approximately 147 million.

The response made its own headlines. Equifax set up a separate site, equifaxsecurity2017.com, for people to check whether they were affected. Security experts thought the long address looked suspicious, and it confused Equifax's own staff: the company's Twitter account pointed customers to securityequifax2017.com for nearly two weeks, a fake site built by a security researcher with the words flipped. The real site and the call centers, which Equifax had planned to staff with 1,500 temporary agents, were overwhelmed from the first day.

Who paid for it

The chief information officer and chief security officer took early retirements on September 15. Smith left on September 26. On October 2, the day Mandiant wrapped up its investigation, Equifax fired Payne for failing to forward the March 9 email. He was one of 430 people on the list and, he told House investigators, had been copied for information only. The House report notes that he was fired the day before Smith testified to Congress. In that testimony, Smith pointed to human error and a failure to communicate the need to apply a patch. The report calls the firing "gratuitous."

On July 22, 2019, Equifax agreed to pay at least $575 million, and possibly as much as $700 million, in a settlement with the FTC, the Consumer Financial Protection Bureau and 50 states and territories. The deal set aside $300 million for a consumer fund, with up to $125 million more if the first sum fell short, and it added $175 million for the states, $100 million in civil penalties for the CFPB and six free credit reports a year for seven years, starting in January 2020, on top of the one free report a year that the bureaus already provided.

The FTC's chairman at the time, Joe Simons, described the failure this way: "Equifax failed to take basic steps that may have prevented the breach that affected approximately 147 million consumers."

The free fix for regular people

The House report notes that consumers don't hand their information to credit bureaus voluntarily and have no way to opt out of it. That's why the useful moves are the ones that make stolen data harder to use.

The first is a credit freeze. A freeze blocks new creditors from seeing your credit file, which makes it harder for an identity thief to open an account in your name, and it stays in place until you lift it. Since September 21, 2018, federal law has made freezes free. The Consumer Financial Protection Bureau's guidance is to contact each of the three nationwide credit bureaus (Equifax, Experian and TransUnion) separately, because a freeze at one doesn't carry over to the others.

The timing rules are short. When you ask online or by phone, a bureau must place the freeze within one business day. A lift must happen within one hour, and you can lift one temporarily for a stretch of time you pick. A freeze doesn't affect your credit score. Companies you already do business with can still see your file, and you can still request and review your own reports. The trade-off is that creditors typically won't offer you credit while they can't see your file, so you'll lift the freeze before applying for a new card or loan.

A freeze isn't the only tool. A fraud alert tells businesses that check your credit to verify your identity before opening a new account. You place one with any single bureau, and that bureau must notify the other two. Since the same September 2018 change, an initial fraud alert lasts one year instead of 90 days.

Parents have a version of freezes too. Federal law allows a free freeze for a child under 16, and a guardian can request one for someone they look after. The bureaus will even create a frozen record for a child who doesn't have a file yet.

Separately, federal law gives you one free copy of your credit report each year from each of the three bureaus, available at AnnualCreditReport.com. Reviewing the reports is one way to look for an account you didn't open.

The CFPB also points out that the bureaus sell "credit locks." They work similarly, but they often come with fees or bundled services, and the CFPB's guidance is that a lock is no more effective than a freeze, which is free and backed by law.

The second move connects to the March 9 email. The Cybersecurity and Infrastructure Security Agency tells consumers to install software updates as soon as they're notified, and to turn on automatic updates so the device installs them without waiting. Equifax had 430 people on a mailing list and a 48-hour deadline. Your phone can do the same job in the background, and it doesn't need a meeting.

One requirement in the settlement runs on a schedule. Every two years, an outside assessor has to review Equifax's information security program, spell out the evidence behind its conclusions and carry out its own sampling, employee interviews and document reviews.

References

1. Source: U.S. House Committee on Oversight and Government Reform, "The Equifax Data Breach: Majority Staff Report," 115th Congress, December 2018: https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf
2. Source: Federal Trade Commission, "Equifax to Pay $575 Million as Part of Settlement with FTC, CFPB, and States Related to 2017 Data Breach," press release, July 22, 2019 (full text as distributed by the FTC through PR Newswire): https://www.prnewswire.com/news-releases/equifax-to-pay-575-million-as-part-of-settlement-with-ftc-cfpb-and-states-related-to-2017-data-breach-300888497.html
3. Source: Apache Software Foundation, "Response From The Apache Software Foundation To Questions From US House Committee On Energy And Commerce Regarding Equifax Data Breach," Oct 3, 2017: https://blogs.apache.org/foundation/entry/responses-to-questions-from-us
4. Source: U.S. Department of Justice, "Chinese Military Personnel Charged with Computer Fraud, Economic Espionage and Wire Fraud for Hacking into Credit Reporting Agency Equifax," Feb 10, 2020: https://www.justice.gov/archives/opa/pr/chinese-military-personnel-charged-computer-fraud-economic-espionage-and-wire-fraud-hacking
5. Source: Consumer Financial Protection Bureau, "Free credit freezes are here," Sept 21, 2018: https://www.consumerfinance.gov/archive/blog/free-credit-freezes-are-here/
6. Source: Consumer Financial Protection Bureau, "What is a credit freeze or security freeze on my credit report?" (last reviewed Sept 5, 2025): https://www.consumerfinance.gov/ask-cfpb/what-is-a-credit-freeze-or-security-freeze-on-my-credit-report-en-1341/
7. Source: USAGov, "How to place or lift a security freeze on your credit report" (last updated Nov 13, 2025): https://www.usa.gov/credit-freeze
8. Source: Consumer Financial Protection Bureau, "Credit reports and scores key terms" (free annual reports and fraud alerts): https://www.consumerfinance.gov/consumer-tools/credit-reports-and-scores/answers/key-terms/
9. Source: Cybersecurity and Infrastructure Security Agency, "Update Software": https://www.cisa.gov/secure-our-world/update-software