Equifax data breach (2017)
The theft of personal data on about 147 million people from US credit bureau Equifax in 2017, through a flaw patched two months earlier, later attributed to Chinese military hackers.
Equifax holds the credit histories of a large part of the US population. The attackers got in through a dispute portal running a version of Apache Struts whose flaw had been public and patched since March 2017, and they stayed inside for more than two months. The case became the benchmark for a known, unpatched vulnerability, which insurers now distinguish from a zero-day flaw, sometimes with exclusions or coinsurance that rises with the time elapsed since the patch. It also showed the full chain of costs of a massive breach: notification, credit monitoring, regulatory penalties, class actions, executive departures. Its late attribution to a state, more than two years on, was a reminder that a breach handled as criminal can turn out to be an intelligence operation.
Equifax disclosed the breach on September 7, 2017. On July 22, 2019, it reached a settlement of up to 700 million dollars with the FTC, the CFPB and the states. On February 10, 2020, the Justice Department indicted four members of China's People's Liberation Army for the intrusion.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.