Quick answer: In 2017, hackers exploited a known flaw in the Apache Struts software on Equifax’s online dispute portal, months after a fix was available. They stole names, dates of birth and Social Security numbers of about 147 million people. In 2020 the US Department of Justice charged four members of China’s military with the hack. Equifax agreed to pay at least $575 million, and up to $700 million, in a settlement with US regulators and states.
| Key facts | |
|---|---|
| Date | Breach May to July 2017; disclosed September 2017 |
| Organization | Equifax (US credit reporting agency) |
| Type of attack | Data breach through an unpatched vulnerability |
| Attacker | Four members of China’s People’s Liberation Army, charged in February 2020 |
| How they got in | A known Apache Struts vulnerability on the online dispute portal that had not been patched |
| Impact | Data on about 147 million people; settlement of up to $700 million |
Timeline
- March 2017: A fix for the Apache Struts vulnerability is released, but Equifax’s dispute portal is not patched.
- May to July 2017: Attackers exploit the flaw and steal data over several weeks.
- September 2017: Equifax announces the breach.
- July 2019: Equifax agrees a settlement of up to $700 million with the FTC, the CFPB and US states.
- 10 February 2020: The Justice Department charges Wu Zhiyong, Wang Qian, Xu Ke and Liu Lei of the PLA’s 54th Research Institute.
What happened
Equifax holds credit data on hundreds of millions of people. In 2017, attackers found that its online dispute portal still ran a version of the Apache Struts web framework with a known, critical vulnerability. A patch had been available since March 2017.
Using that flaw, the attackers got in and, over several weeks, stole names, dates of birth and Social Security numbers of about 147 million people. They routed their traffic through about 34 servers in nearly 20 countries to hide where they were.
Who did it
On 10 February 2020, Attorney General William Barr announced charges against four members of the Chinese People’s Liberation Army’s 54th Research Institute: Wu Zhiyong, Wang Qian, Xu Ke and Liu Lei. Barr described it as one of the largest data breaches in history.
The settlement
In July 2019, Equifax agreed to pay at least $575 million, and potentially up to $700 million, in a settlement with the Federal Trade Commission, the Consumer Financial Protection Bureau and 50 US states and territories. The FTC alleged the breach resulted from Equifax’s failure to take basic security measures.
Lessons for your organization
- Keep a complete inventory of internet-facing applications and the components they use.
- Patch critical, known vulnerabilities on public systems within days, not months.
- Check that patches were actually applied, rather than assuming.
- Monitor for large or unusual data transfers out of the network.
- Encrypt and limit access to the most sensitive data, such as identity numbers.
This incident is part of our guide to major cyber attacks and data breaches, which compares the biggest incidents and the patterns behind them. See our patch management software comparison. To see whether the same weaknesses exist in your organization, take the free Cybersecurity Readiness Assessment.
Related reading
Change Healthcare Ransomware Attack: The Largest US Healthcare Breach
Frequently asked questions
How did the Equifax breach happen?
Attackers exploited a known Apache Struts vulnerability on Equifax’s online dispute portal that had not been patched.
How many people were affected by the Equifax breach?
About 147 million people had their names, dates of birth and Social Security numbers stolen.
Who hacked Equifax?
The US Justice Department charged four members of China’s People’s Liberation Army in February 2020.
