What caused the Equifax breach? An unpatched website and an expired certificate

For at least 10 months before anyone noticed, a security device at Equifax that was supposed to inspect encrypted web traffic had been effectively blind, because a digital certificate it relied on had expired.^[1] This case file walks through how an unpatched flaw in a consumer dispute website led to the exposure of personal data on about 147 million people, how it was finally spotted, what it cost, and the two plain habits that would have stopped it.^[4]

What happened

How they got in

The front door was the known Struts flaw. Because the dispute portal was still running the old version months after the fix came out, the attackers could send it specially crafted requests that made the server run commands on their behalf.^[3] That gave them a foothold inside Equifax's network.

Three weaknesses turned that foothold into a disaster. First, the network was not divided into walled-off sections, so a break-in at one public website could reach 48 unrelated databases.^[2] Second, credentials were stored unencrypted where the intruders could read them, which let them log in to more systems.^[1] Third, nothing limited how many queries could be run, so thousands of requests pulling out personal data went unchallenged.^[1]

According to the Justice Department, the intruders also covered their tracks: they routed traffic through about 34 servers in nearly 20 countries, used encrypted channels, and deleted log files.^[3] Encrypted traffic is exactly what the inspection device was meant to examine, and with its certificate expired, it was not examining anything. A congressional investigation found Equifax had let more than 300 security certificates lapse, including 79 used to monitor business-critical domains.^[2]

How it was caught and what it cost

Nobody caught the intruders through a clever investigation. Detection came as a side effect of routine maintenance: renewing the lapsed certificate switched the inspection back on, and the suspicious traffic was visible almost at once.^[2] Equifax then brought in an outside incident-response firm on August 2.^[5]

Stolen data included names, Social Security numbers, birth dates, addresses and some driver's license numbers, plus about 209,000 credit card numbers.^[1] Equifax's chief executive stepped down before testifying to Congress in October 2017 that the breach came from both human error and technology failures.^[5] A House committee report later called the breach "entirely preventable."^[2]

In July 2019, Equifax agreed to a settlement with the Federal Trade Commission, the Consumer Financial Protection Bureau 48 states, Washington, D.C., and Puerto Rico worth at least $575 million and up to $700 million, including up to $425 million for affected consumers, $175 million to the states and a $100 million civil penalty to the CFPB.^[4]

In February 2020, the Justice Department charged four members of China's People's Liberation Army with computer fraud, economic espionage and wire fraud. DOJ attributed the intrusion to that unit of the Chinese military. The four were charged only; none has been tried.^[3]

The missing control

The missing control: timely patching, backed by verified monitoring that proves your security tools are actually working.

Equifax did send the patch notice. What it lacked was follow-through: no one confirmed the dispute portal had actually been updated, and the FTC said the company did not check that its own patch order was carried out.^[4] A patch applied in March would have closed the door two months before the attackers walked through it.

The second half matters just as much. A monitoring tool that silently stops working is worse than none, because it creates false confidence. A simple check that the inspection device was seeing traffic, or an alert when its certificate was about to expire, would likely have cut the 76 days down to hours or days.

What to do in your business

• Keep a list of what you run. Write down every website, server, laptop and piece of software your business depends on, and who is responsible for updating each one. You cannot patch what you forgot you had.
• Turn on automatic updates, then verify. Enable auto-updates wherever you can, and once a month check that critical systems actually show the latest version instead of assuming they do.
• Put expiration dates on a calendar. Security certificates, domain names and software licenses all expire. Add each renewal date to a shared calendar with a reminder 30 days ahead.
• Test your alarms. Once a quarter, confirm your antivirus, firewall and backup tools are running and reporting. Ask your IT provider to show you a recent alert, not just tell you things are fine.
• Do not store passwords in plain text. Use a password manager, and make sure logins for one system are not sitting in a file that another system can read.

Facts are drawn from court records, government reports and reputable reporting, listed below. People are named only where they were convicted or spoke publicly in an official role.