On May 13, 2017, a critical vulnerability in Apache Struts was publicly disclosed. On May 13, 2017, an unknown threat actor began exploiting that vulnerability against Equifax's online dispute resolution portal. Equifax didn't know their systems were being compromised; they didn't know they had unpatched systems running the vulnerable version; their SSL traffic inspection certificate had expired, rendering their monitoring tools blind to the attack. When the breach was publicly disclosed on September 7, 2017, Equifax announced that the personal information of 147.9 million Americans had been stolen. This is the story of how one of the three major credit bureaus left the financial data of half the United States unprotected.
Apache Struts and CVE-2017-5638
Apache Struts is a widely-deployed Java web application framework. CVE-2017-5638 was a remote code execution vulnerability in Struts' handling of multipart file uploads - specifically, in the Jakarta Multipart parser's error handling. When an attacker sent a malformed Content-Type header in a file upload request, Struts would evaluate the malformed value using the OGNL expression language before throwing an exception. If the malformed value was valid OGNL, it would execute as arbitrary Java code on the server.
The vulnerability was trivially exploitable: a single HTTP request with a crafted Content-Type header could execute arbitrary commands on any unpatched Struts server. Proof-of-concept exploits were publicly available on the same day the CVE was published - March 7, 2017. CISA (then US-CERT) issued an advisory. Apache released patches. The entire security community was aware within 24 hours.
Equifax had systems running vulnerable versions of Apache Struts. They had received the US-CERT advisory. Their internal policy required patching critical vulnerabilities within 48 hours. The patch was not applied.
%{#[email protected]@DEFAULT_MEMBER_ACCESS,@java.lang.Runtime@getRuntime().exec('command')}. The expression evaluated before the exception was thrown, executing the embedded command with the privileges of the web application. No authentication required.The 78-Day Dwell Time
From May 13 - when exploitation began - to July 29, when Equifax's security team discovered the intrusion, the attackers had 76 days of undetected access. During this period, they conducted reconnaissance across Equifax's network, identified databases containing consumer credit information, and exfiltrated data over 76 days.
The SSL inspection tool Equifax used to monitor encrypted network traffic had been operating with an expired certificate since January 2017. For seven months before the breach was discovered, Equifax's network monitoring was functionally blind to encrypted traffic leaving their environment. The attackers encrypted their exfiltration. The expiring certificate had generated no alerts because the monitoring system itself continued running; it simply wasn't decrypting the traffic it was supposed to inspect.
The data exfiltrated included: names, Social Security numbers, birth dates, addresses, driver's license numbers, and credit card numbers for 147.9 million Americans. An additional 209,000 credit card numbers were exposed separately. The stolen data represented approximately 45% of the US population.
Post-Breach Response and Congressional Testimony
Equifax CEO Richard Smith resigned on September 26, 2017, eighteen days after the public disclosure. Chief Information Officer David Webb and Chief Security Officer Susan Mauldin both "retired" the same day as the public disclosure. Mauldin's academic credentials subsequently received scrutiny when journalists noted her degrees were in music composition rather than information security.
Smith testified before the Senate Banking Committee and the House Energy and Commerce Committee in October 2017. The testimony produced several notable exchanges. Smith described the breach as resulting from "a single individual" who failed to ensure the patch was applied. He could not explain why the SSL certificate had been expired for seven months. He acknowledged that Equifax had purchased Lifelock identity protection services in a major prior acquisition and had failed to implement its own security protocols adequately.
The House Energy and Commerce Committee investigation concluded that "Equifax's response to the breach was woefully inadequate." The committee found that Equifax had received specific warnings about vulnerabilities in their systems and had failed to act, that the patch management and monitoring failures were systemic rather than isolated, and that Equifax had been aware of security weaknesses in the ACIS dispute portal (the entry point) for months before the breach.
Legal Consequences
The legal resolution of the Equifax breach was substantial but widely criticized as inadequate. The Federal Trade Commission, Consumer Financial Protection Bureau, and state attorneys general reached a settlement in July 2019. The settlement required Equifax to pay up to $575 million ($700M if demand was high enough), with a $300M fund for consumer credit monitoring and cash payments of up to $125 per affected consumer.
The $125 consumer payment immediately became symbolic when the FTC announced that actual payouts would be approximately $5.21 due to the number of claims filed. The settlement structure had allocated funds that were insufficient if a significant percentage of affected consumers claimed them. The FTC's guidance to consumers - to take the credit monitoring option rather than the cash payment - struck many observers as ironic, given that the breached company was itself in the credit monitoring business.
In the United Kingdom, the Information Commissioner's Office fined Equifax £500,000 - the maximum allowed under the pre-GDPR Data Protection Act - for failing to protect UK consumer data. The fine was the maximum possible under the applicable law; under GDPR, which came into force four months after the breach, the maximum would have been approximately £1.6 billion.
Attribution
In February 2020, the US Department of Justice indicted four members of the People's Liberation Army Unit 54 for the Equifax breach: Wu Zhiyong, Wang Qian, Xu Ke, and Liu Lei. The indictment alleged the defendants had stolen the trade secrets of Equifax's data and compiled the stolen personal information across multiple databases.
The attribution to PLA Unit 54 connected the Equifax breach to China's ongoing collection of US consumer and government data - paralleling the OPM breach of 2015. The combination of OPM's government personnel files and Equifax's consumer credit data gives Chinese intelligence a comprehensive dataset on Americans' financial history, creditworthiness, address history, and government clearance status.
None of the four indicted defendants were extradited. The charges stand as a statement of attribution; the practical consequences for the defendants were limited to restrictions on international travel to jurisdictions with extradition agreements with the United States.
The Systemic Failure
The Equifax breach is often analyzed as a series of discrete failures - the unpatched server, the expired certificate, the inadequate logging. These individual failures existed, but the underlying condition was more fundamental: Equifax collected personal financial data on virtually every American adult as a normal business operation, was not required to disclose what data it held or how it was protected, and had no legal obligation to those individuals whose data it had obtained without their consent.
Credit bureaus exist in a legal structure where the people whose data they hold are not their customers - lenders are. The individual American has no relationship with Equifax and no contractual right to demand any level of security. The regulatory oversight that existed was insufficient to enforce the security practices that the scale and sensitivity of the data required. The Equifax breach demonstrated, with 147 million specific names attached, that this arrangement was not sustainable.