EQUIFAX DATA BREACH

Equifax is one of three big American credit agencies having one of the largest human intel
databases in the world breached. In 2017 Equifax had a data breach which impacted around
147,700,000 people. The hacked (stolen) information and data include customers’ names,
addresses, social security numbers, driver's license numbers as well as credit card numbers.

In short, Equifax was breached when a hacker discovered that there was an unpatched version of
the APACHE STRUTS software running on a server in their DMZ, facing the internet. What
makes this significant is that during the congressional hearing that followed this breach it was
revealed that the penetration tester had found this vulnerability months before. Well, as per their
official report the breach happened in mid-May of 2017 and there was a patch available for this
vulnerability in March which means 2 months passed after they knew they were vulnerable and
did nothing to fix it.

Because the systems weren't sufficiently isolated from one another, the attackers were able to go
from the web portal to other servers, and they discovered plain-text passwords and usernames
that gave them access to more systems. Well, Equifax had significantly neglected to renew an
encryption certificate on one of its internal security tools, and that is how the attackers were able
to extract data from the network in encrypted form for months without being discovered.
The hack was not made public by Equifax until more than a month after it had been detected.

As a result, the chief management team was accused of corruption in the following month and
blamed for their weak security posture to their poor response to the breach.

Well, this isn’t the largest hack in history solely based on the number of people impacted but
having so many people’s social security numbers compromised is insane. So, here I would like to
present a few numbers that make me intrigued about this breach.

 Firstly, for almost 76 days the hackers were active in the Equifax system without being
discovered by anyone.
 Shockingly 40% of the total population of America was affected by this data breach.
 Around $1.4 billion USD dollars was spent by the company as a cleanup cost to upgrade
its security after this incident.
 In terms of settlement and compensation, the customer can expect a maximum of $125 if
their data was hacked by the hackers. ( Website to see if the customer is affected by the
breach or not: customerhttps://eligibility.equifaxbreachsettlement.com/en/Eligibility)
 After the breach, Equifax developed a site named equifaxsecurity2017.com to provide
information and resources for their customers affected by the data breach.

In connection with the 2017 cyberattack against Equifax, the U.S. Department of Justice filed
charges against four Chinese military-backed hackers.
What we can learn from this breach:

Starting from the DSW Shoe Warehouse data breach to the recent Uber data breach what I have
realized is that all those breaches happen because somebody in that company did something they
weren’t supposed to do or somebody in that company failed to do something they were supposed
to do.

For me, patch and Vulnerability Management is considered an asset to any business and industry.
In simple words “Failure to patch a known critical vulnerability left its system at risk for 145
days (Apache Struts, CVE-2017-5638).” (c) When discussing vulnerability management,
Equifax did scan their Apache Struts servers before the intrusion, but no vulnerabilities were
discovered since "the scan was conducted on the root directory." The obvious solution here is to
configure your programme correctly and maybe try to run it recursively, but I'd also argue that it
could be a good idea to run a second tool to confirm your results.

In the case of Equifax, I think that the data breach has been avoided if they have updated their
software if they have fixed and installed their security patches. I totally agree that as a human we
make mistakes, but I do think that Equifax failed to do a better job in terms of protecting
information, following the instructions said by Microsoft as well.

In the end, I would like to add that “Hacker doesn’t cause breaches, people do” All hackers do
is look for open doors and every day there are thousands of companies with open doors.

References:
(a) Equifax Breach as Cybersecurity Case Study
(b) Equifax data breach FAQ: What happened, who was affected, what was the impact?
(c) 10 Lessons Learned from the Equifax Data Breach
(d) 2017 Equifax Data Breach Incident Explained