On September 7, 2017, Equifax announced that it had suffered a data breach affecting approximately 143 million Americans - subsequently revised to 147.9 million. The data stolen included Social Security numbers, birth dates, home addresses, and in some cases driver's license numbers and credit card numbers. This was not a minor corporate breach: Equifax is one of three companies that maintains comprehensive credit history files on virtually every American adult. The breach exposed the financial identity data of nearly half the US population.

The technical cause was straightforward and avoidable: a known vulnerability in Apache Struts (CVE-2017-5638) had been publicly disclosed in March 2017 with a patch available. Equifax had been notified by US-CERT, had sent an internal notice to patch the vulnerability, and had conducted a scan to identify affected systems. The scan failed to identify the vulnerable server because the scanning tool's certificate had expired. The unpatched server ran for 78 more days, during which Chinese intelligence (PLA Unit 54891) exfiltrated data on 147 million people.

CVE-2017-5638 and the Failure to Patch

Apache Struts is a Java web application framework widely used in enterprise software. CVE-2017-5638 was a critical remote code execution vulnerability in the framework's file upload handling. An attacker could send a specially crafted Content-Type HTTP header that Struts would interpret as an OGNL (Object-Graph Navigation Language) expression and execute on the server. No authentication was required. The exploit was publicly available on GitHub within days of the CVE disclosure on March 7, 2017.

Equifax's cybersecurity department received US-CERT's alert about CVE-2017-5638 and issued an internal directive to patch all affected systems within 48 hours. The directive went out on March 9. A network scan on March 15 was supposed to identify all vulnerable systems, but the scanning tool had an expired TLS certificate that prevented it from inspecting HTTPS traffic. The Equifax dispute resolution portal - the system ultimately compromised - ran over HTTPS and was invisible to the scanner.

The portal ran on the unpatched Apache Struts version until May 13, 2017, when attackers began exploiting it. The exploitation went undetected until July 29, 2017, when an Equifax security analyst noticed suspicious outbound traffic. The company took the portal offline on July 30. By then, the attackers had been inside for 78 days.

[TECHNICAL NOTE]
The Apache Struts exploit used in the Equifax breach (CVE-2017-5638) was a one-line attack: an HTTP request with a Content-Type header containing an OGNL expression that executed on the server. The OGNL injection allowed arbitrary Java code execution in the context of the web application server process. From there, attackers ran database queries against Equifax's backend systems. The subsequent exfiltration was methodical: attackers ran approximately 9,000 queries over 78 days, extracted data in small chunks to avoid triggering volume alerts, and used 34 different IP addresses to avoid triggering single-source detection. The data was staged in temporary directories, compressed, encrypted, and transferred out over encrypted channels. Equifax had intrusion detection systems. They were not configured to decrypt and inspect HTTPS traffic - the exfiltration traffic traversed the network without triggering a single alert for 76 of the 78 days.

The Scale and Sensitivity of the Data

What made the Equifax breach categorically different from most data breaches was the nature of the data. Equifax maintained credit files because it is one of three consumer credit bureaus - along with Experian and TransUnion - that aggregate financial history data on virtually every American adult who has ever had a credit card, loan, or utility account. This data is not collected with user consent; it is collected from lenders and creditors automatically.

The Social Security numbers compromised in the Equifax breach cannot be changed. Unlike passwords or credit card numbers, SSNs are permanent identifiers. A person whose SSN was in the Equifax breach faces elevated identity theft risk indefinitely - not just until they change their password. The breach created a permanent expansion of the population of Americans whose core financial identity data was in the hands of foreign intelligence.

The credit dispute portal that was compromised was particularly sensitive: it contained the documents people submitted when disputing credit file errors - often including copies of driver's licenses, utility bills, and other identity documents submitted to prove identity. The attackers had access to this portal for 78 days.

[WARNING]
The Equifax breach exposed a structural problem in the US credit reporting system: three private companies collect comprehensive financial data on every adult American as a byproduct of commerce, with no meaningful security regulation, no user consent, and no way for individuals to opt out. Freezing your credit file (a post-Equifax right that was previously fee-based in most states) prevents new credit from being opened in your name but does not protect against other uses of SSNs. The three credit bureaus have been breached multiple times collectively. The data they hold - SSN, DOB, address history, account history, employer history - is precisely the data needed to impersonate someone for financial fraud or to verify identity for social engineering attacks. The Equifax breach was not a one-time event; it was a permanent change in the threat landscape for identity theft affecting over 40% of the US adult population.

The Response: Congress, FTC, and the $575 Million Settlement

Equifax CEO Richard Smith resigned in September 2017 and testified before Congress. His testimony revealed that the company had been warned by US-CERT, had issued an internal patch directive, had conducted a scan that missed the vulnerable system due to an expired certificate, and had then not followed up to verify the patch had been applied across all systems.

The Congressional hearings exposed additional failures: Equifax's Chief Information Officer and Chief Security Officer both announced their retirements shortly after the breach disclosure. The company had stored Social Security numbers in plaintext in some databases rather than encrypting them at rest. Internal security practices across the organization were found to be inadequate.

In July 2019, Equifax reached a settlement with the FTC, Consumer Financial Protection Bureau, and all 50 state attorneys general for $575 million - up to $700 million depending on claims. Affected consumers were entitled to free credit monitoring or a cash payment of up to $125 (though the cash payment was reduced to approximately $5.21 due to the volume of claims). The settlement was one of the largest data breach settlements in US history.

Attribution: PLA Unit 54891

In February 2020, the Department of Justice indicted four members of the Chinese People's Liberation Army - Wu Zhiyong, Wang Qian, Xu Ke, and Liu Lei - all from PLA Unit 54891. The indictment alleged they had hacked Equifax's systems and stolen the data of 145.5 million Americans along with Equifax's trade secrets and internal data.

The attribution aligned with Chinese intelligence doctrine: the OPM background investigation records (stolen 2015), the Marriott hotel database (stolen 2014-2018, also attributed to Chinese intelligence), and the Equifax consumer credit files together created a comprehensive dataset covering most American adults. Cross-referencing the three datasets could identify intelligence officers, their financial situations, their travel patterns, and their family connections - a national-scale human intelligence resource.

No extradition is anticipated. The four indicted PLA officers remain in China. The indictments were symbolic but continued the US practice of public attribution to establish norms and create documented records of Chinese state espionage activity.

[IOC]
CVE-2017-5638 (Apache Struts file upload RCE): affects Apache Struts 2.3.x before 2.3.32, and 2.5.x before 2.5.10.1. Patch: upgrade to Struts 2.3.32 or 2.5.10.1 or later. Detection: WAF signatures for OGNL injection in Content-Type headers; any Content-Type value containing "%" characters in multipart form submissions is suspicious. The exploit is trivially scriptable and was automated in the wild within days of CVE publication. Remediation note: the Equifax failure illustrates that patch management requires verification of completion, not just issuance of directives. Patch scanning tools that cannot inspect HTTPS traffic (due to certificate issues or lack of SSL inspection) will produce false negatives for HTTPS-only services. Asset inventory completeness - knowing all internet-facing services - is a prerequisite for effective patch management. The Equifax breach resulted in PCI DSS requirement updates and NIST guidance updates specifically addressing patch verification processes.