Equifax 2017 Data Breach: 147 Million Records Exposed

The Equifax breach exploited a known Apache Struts vulnerability that had a patch available for months before attackers gained access. Equifax failed to apply the patch despite internal scanning that should have identified the vulnerable system. Attackers had access to systems for 76 days before detection. The breach exposed the most sensitive financial identity data including Social Security numbers, making it one of the most damaging breaches for affected individuals. Congressional investigations revealed systemic security failures at Equifax including an expired SSL certificate that prevented a security tool from detecting the intrusion for months.

The breach at Equifax exposed 147 million records through exploitation of unpatched apache struts vulnerability (cve-2017-5638). Approximately 147 million Americans — nearly half the US population at the time The incident highlights the ongoing challenges organizations face in protecting sensitive user data against increasingly sophisticated attack vectors. Security researchers have noted that breaches of this magnitude often result from a combination of technical vulnerabilities and organizational failures in security practices.

Current status: Settled for $700 million with FTC in 2019; affected individuals eligible for up to $20,000 in compensation. Affected users should take immediate steps to protect their accounts, including changing passwords, enabling multi-factor authentication, and monitoring financial accounts for unauthorized activity. Filing a DSAR with Equifax can help you understand what data was exposed and request its deletion.