2017 Equifax data breach

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search

The Equifax data breach occurred between May and July 2017 at the American credit bureau Equifax. Private records of more than 140 million Americans, along with some British and Canadian citizens were compromised in the breach, making it one of the largest cybercrimes related to identity theft.

In a settlement with the United Stated Federal Trade Commission, Equifax offered affected uses settlement funds and free credit monitoring. The United States government has stated that members of China's military were behind the breach, though China has refuted these claims.

Data breach[edit]

The data breach into Equifax was principally through a third-party software exploit that had been patched, but which Equifax had not updated on their servers. Equifax had been using the open-source Apache Struts as its website framework for systems handling credit disputes from consumers. A key security patch for Apache Struts was released on March 7, 2017 after a security exploit was found and all users of the framework were urged to update immediately.[1] Security experts found an unknown hacking group trying to find websites that had failed to update Struts as early as March 10, 2017, as to find a system to exploit.[2]

As determined through postmortem analysis, the breach at Equifax started on May 12, 2017, as Equifax had yet to update its credit dispute website with the new version of Struts.[3][4] The hackers used the exploit to gain access to internal servers on Equifax' corporate network. Among information first pulled by the hackers included internal credentials for Equifax employees, which allowed the hackers to search the credit monitoring databases under the guise of an authorized user. Using encryption to further mask their searches, the hackers performed more than 9000 scans of the databases, extracted information into small temporary archives that were then transferred off the Equifax servers to avoid detection and removed the temporary archives once complete.[5] The activities went on for 76 days until July 29, 2017 when Equifax discovered the breach,[6][7][8] and subsequently, by July 30, 2017, has shut off the exploit.[2] At least 34 servers in twenty different countries were used at different points during the breach, making tracking the perpetrators difficult.[5] While the failure to update Struts was a key failure, analysis of the breach found further faults in Equifax' system that made it easy for the breach to occur, including the insecure network design which lacked sufficient segmentation,[9] potentially inadequate encryption of personally identifiable information (PII),[10] and ineffective breach detection mechanisms.[11]

Information accessed in the breach included first and last names, Social Security numbers, birth dates, addresses and, in some instances, driver's license numbers for an estimated 143 million Americans, based on Equifax' analysis.[7] Information on an estimated range of under 400,000 up to 44 million British residents as well as 8,000 Canadian residents were also compromised.[12][13][14][15][16] An additional 11,670 Canadians were affected as well, later revealed by Equifax.[17] Credit card numbers for approximately 209,000 U.S. consumers, and certain dispute documents with personal identifying information for approximately 182,000 U.S. consumers were also accessed.[18][8]

Since the initial disclosure in September 2017, Equifax expanded the number of records that they discovered were accessed. In both October 2017 and March 2018, Equifax reported that an additional 2.5 and 2.4 million American consumer records were accessed, respectively, bringing the total to 147.9 million.[19][20] Equifax narrowed its estimate for UK consumers affected by the breach to 15.2 million in October 2017,[21][22] of which 693,665 had sensitive personal data disclosed.[23][24][21][25][22] Equifax also estimated that the number of drivers' licenses breached in the attack to be 10-11 million.[26][27][28]

Security experts expected that the lucrative private data from the breach would be turned around and sold on black markets and the dark web, though as of February 2020, there has been no sign of any sale of this data.[29] Because the data was not immediately show up in the first 17 months following the breach, security experts theorized that either the hackers behind the breach were waiting for a significant amount of time before selling the information since it would be too "hot" to sell that close to the breach, or that a nation-state was behind the breach and planning on using the data in a non-financial manner such as for espionage.[30]

Disclosure[edit]

Equifax disclosed the breach and its scope, affecting over 140 million Americans, on September 7, 2017.[31] VentureBeat called the exposure of data on 140+ million customers "one of the biggest data breaches in history."[32] Equifax shares dropped 13% in early trading the day after the breach was made public.[33]

On September 15, Equifax released a statement saying that it had hired Mandiant on August 2 to internally investigate the intrusion. The statement, however, did not specify precisely when government authorities ("all U.S. State Attorneys General" and "other federal regulators") were notified of the breach, although it did assert "the company continues to work closely with the FBI in its investigation".[8]

Short-term responses[edit]

Numerous media outlets advised consumers to request a credit freeze to reduce the impact of the breach.[34][35][36][37]

On September 15, Equifax issued a press release with bullet-point details of the intrusion, its potential consequences for consumers, and the company's response. The statement further commented on issues related to criticism regarding its initial response to the incident. The company also announced the immediate departures and replacements of its Chief Information Officer and Chief Security Officer.[8][38]

Three days after Equifax revealed the May–July 2017 breach, Congressman Barry Loudermilk (R-GA), who had been given thousands of dollars in campaign funding from Equifax,[39][40] introduced a bill to the U.S. House of Representatives that would reduce consumer protections in relation to the nation's credit bureaus, including capping potential damages in a class action suit to $500,000 regardless of class size or amount of loss.[41] The bill would also eliminate all punitive damages.[41][42] Following criticism by consumer advocates, Loudermilk agreed to delay consideration of the bill "pending a full and complete investigation into the Equifax breach".[41]

On September 28, 2017, new Equifax CEO Paulino do Rego Barros Jr. responded to criticism of Equifax by promising that the company would, from early 2018, allow "all consumers the option of controlling access to their personal credit data", and that this service would be "offered free, for life".[43]

Litigation[edit]

Numerous lawsuits were filed against Equifax in the days after the disclosure of the breach.[44][45] In one suit the law firm Geragos & Geragos has indicated they would seek up to $70 billion in damages, which would make it the largest class-action suit in U.S. history.[44] Since October 2017, hundreds of consumers have sued Equifax for the data breach, some winning small claims cases in excess of $9,000, including actual damages, future damages, anxiety, monitoring fees and punitive damages.[46]

In September, 2017, Richard Cordray, then director of the Consumer Financial Protection Bureau (CFPB), authorized an investigation into the data breach on behalf of affected consumers. However, in November, 2017, Mick Mulvaney, President Donald Trump's budget chief, who was appointed by Trump to replace Cordray, was reported by Reuters to have "pulled back" on the probe, along with shelving Cordray's plans for on-the-ground tests of how Equifax protects data. The CFPB also rebuffed bank regulators at the Federal Reserve Bank, Federal Deposit Insurance Corporation and Office of the Comptroller of the Currency who offered to assist with on-site exams of credit bureaus.[47] Senator Elizabeth Warren, who released a report on the Equifax breach in February 2018, criticized Mulvaney's actions, stating: "We're unveiling this report while Mick Mulvaney is killing the consumer agency's probe into the Equifax breach. Mick Mulvaney shoots another middle finger at consumers."[48]

On July 22, 2019, Equifax agreed to a settlement with the Federal Trade Commission (FTC), CFPB, 48 U.S. states, Washington, D.C., and Puerto Rico to alleviate damages to affected individuals and make organizational changes to avoid similar breaches in the future. The total cost of the settlement included $300 million to a fund for victim compensation, $175 million to the states and territories in the agreement, and $100 million to the CFPB in fines.[49] In July 2019, the FTC published information on how affected individuals could file a claim against the victim compensation fund using the website EquifaxBreachSettlement.com.[50]

Perpetrators[edit]

The United States Department of Justice announced on February 10, 2020 that they had indicted four members of China's military on nine charges related to the hack, though there was no additional evidence that China had used the data from the hack since.[51][52] China denied that the four accused had any involvement with the hack.[29]

Criticism[edit]

Following the announcement of the May–July 2017 breach, Equifax's actions received widespread criticism. Equifax did not immediately disclose whether PINs and other sensitive information were compromised, nor did it explain the delay between its discovery of the breach in July and its public announcement in early September.[53] Equifax stated that the delay was due to the time needed to determine the scope of the intrusion and the large amount of personal data involved.[54]

It was also revealed that three Equifax executives sold almost $1.8 million of their personal holdings of company shares days after Equifax discovered the breach but more than a month before the breach was made public.[55] The company said the executives, including the chief financial officer John Gamble,[56][33] "had no knowledge that an intrusion had occurred at the time they sold their shares".[57] On September 18, Bloomberg reported that the U.S. Justice Department had opened an investigation to determine whether or not insider trading laws had been violated.[58] "As Bloomberg notes, these transactions were not pre-scheduled trades and they took place on August 2, three days after the company learned of the hack".

When publicly revealing the intrusion to its systems, Equifax offered a website (https://www.equifaxsecurity2017.com[59]) for consumers to learn whether they were victims of the breach. Security experts quickly noted that the website had many traits in common with a phishing website: it was not hosted on a domain registered to Equifax, it had a flawed TLS implementation, and it ran on WordPress which is not generally considered suitable for high-security applications. These issues led Open DNS to classify it as a phishing site and block access.[60] Moreover, members of the public wanting to use the Equifax website to learn if their data had been compromised had to provide a last name and six digits of their social security number.[61]

The website set up to check whether a person's personal data had been breached (trustedidpremier.com) was determined by security experts and others to return apparently random results instead of accurate information.[61] As with https://www.equifaxsecurity2017.com, this website, too, was registered and constructed like a phishing website, and it was flagged as such by several web browsers.[62]

The Trusted ID Premier website contained terms of use, dated September 6, 2017 (the day before Equifax announced the security breach) which included an arbitration clause with a class action waiver.[63][64] Attorneys said that the arbitration clause was ambiguous and that it could require consumers who accepted it to arbitrate claims related to the cybersecurity incident.[64] According to Polly Mosendz and Shahien Nasiripour, "some fear[ed] that simply using an Equifax website to check whether their information was compromised bound them to arbitration".[65] The equifax.com website has separate terms of use with an arbitration clause and class action waiver, but, according to Brian Fung of The Washington Post, "it's unclear if that applies to the credit monitoring program".[66] New York Attorney General Eric Schneiderman demanded that Equifax remove the arbitration clause.[67] Responding to arbitration-related concerns, on September 8, Equifax issued a statement stating that "in response to consumer inquiries, we have made it clear that the arbitration clause and class action waiver included in the Equifax and TrustedID Premier terms of use does not apply to this cybersecurity incident".[67] Joel Winston, a data protection lawyer, argued that the announcement disclaiming the arbitration clause "means nothing" because the terms of use state that they are the "entire agreement" between the parties.[67] The arbitration clause was later removed from equifaxsecurity2017.com,[67] and the equifax.com terms of use were amended on September 12 to state that they do not apply to www.equifaxsecurity2017.com, www.trustedidpremier.com, or www.trustedid.com and to exclude claims arising from those sites or the security breach from arbitration.[68][69]

Responding to continuing public outrage,[70] Equifax announced on September 12 that they "are waiving all Security Freeze fees for the next 30 days".[71]

Equifax has been criticized by security experts for registering a new domain name for the site name instead of using a subdomain of equifax.com. On September 20, it was reported that Equifax had been mistakenly linking to an unofficial "fake" web site instead of their own breach notification site in at least eight separate tweets, unwittingly helping to direct a reported 200,000 hits to the imitation site. A software engineer named Nick Sweeting created the unauthorized Equifax web site to demonstrate how the official site could easily be confused with a phishing site. Sweeting's site was upfront to visitors that it was not official, however, telling visitors who had entered sensitive information that "you just got bamboozled! this isnt [sic] a secure site! Tweet to @equifax to get them to change it to equifax.com before thousands of people loose [sic] their info to phishing sites!" Equifax apologized for the "confusion" and deleted the tweets linking to this site.[72][73][74]

See also[edit]

References[edit]

  1. ^ "CVE-2017-5638 - Apache Struts2 S2-045 #8064". GitHub. March 7, 2017. Retrieved September 16, 2017.
  2. ^ a b Ng, Alfred (September 7, 2018). "How the Equifax hack happened, and what still needs to be done". CNet. Retrieved February 11, 2020.
  3. ^ Whittaker, Zack. "Equifax confirms Apache Struts flaw it failed to patch was to blame for data breach". ZDNet. Retrieved September 14, 2017.
  4. ^ "Failure to patch two-month-old bug led to massive Equifax breach". Ars Technica. September 14, 2017. Retrieved September 14, 2017.
  5. ^ a b Bomey, Nathan (February 10, 2020). "How Chinese military hackers allegedly pulled off the Equifax data breach, stealing data from 145 million Americans". USA Today. Retrieved February 11, 2020.
  6. ^ Equifax (September 7, 2017), Rick Smith, Chairman and CEO of Equifax, on Cybersecurity Incident Involving Consumer Data., retrieved September 12, 2017
  7. ^ a b Haselton, Todd (September 7, 2017). "Credit reporting firm Equifax says cybersecurity incident could potentially affect 143 million US consumers". cnbc.com. Retrieved September 8, 2017.
  8. ^ a b c d "Equifax Releases Details on Cybersecurity Incident, Announces Personnel Changes". investor.equifax.com. Retrieved September 16, 2017.
  9. ^ Newman, Lily Hay. "How to Stop the Next Unstoppable Mega-Breach—Or Slow It Down". WIRED. Retrieved September 29, 2017.
  10. ^ Gallagher, Sean. "Equifax hackers stole data for 200k credit cards from transaction history". Ars Technica. Retrieved September 29, 2017.
  11. ^ Lomas, Natasha. "Equifax breach disclosure would have failed Europe's tough new rules". TechCrunch. Retrieved September 29, 2017.
  12. ^ Shepardson, David (October 2, 2017). "Equifax failed to patch security vulnerability in March: former CEO". Reuters. Reuters. Retrieved October 3, 2017.
  13. ^ Hern, Alex (September 8, 2017). "Equifax told to inform Britons whether they are at risk after data breach". The Guardian. Retrieved September 11, 2017.
  14. ^ Isai, Vjosa (September 7, 2017). "Canadians among 143 million people affected in Equifax hack". The Toronto Star. Hackers targeted names, Social Security numbers, birth dates, addresses and driver's licence numbers, Equifax said in a statement. "Limited personal information" from residents in Canada and the U.K. was also accessed, it said.
  15. ^ "Equifax confirms Britons hit by breach". BBC News. September 15, 2017. Retrieved September 16, 2017.
  16. ^ Ligaya, Armina (September 19, 2017). "Equifax says 100,000 Canadians affected by cyberattack". CTVNews. Retrieved September 21, 2017.
  17. ^ "Equifax doubles number of Canadians hit by breach, now more than 19,000 | CBC News". CBC. Retrieved 2018-06-23.
  18. ^ "Cybersecurity Incident & Important Consumer Information | Equifax". Cybersecurity Incident & Important Consumer Information. Retrieved September 7, 2017.
  19. ^ Weise, Elizabeth; Bomey, Nathan (October 2, 2017). "Equifax breach hit 2.5 million more Americans than first believed". USA Today. Retrieved October 4, 2017.
  20. ^ "Equifax Data Breach Lawsuit", Morgan & Morgan.
  21. ^ a b "Equifax says 15.2 million UK records exposed in cyber breach". Reuters. October 10, 2017. Retrieved October 11, 2017.
  22. ^ a b "Latest information on the Equifax cyber incident - NCSC Site". www.ncsc.gov.uk. Retrieved October 13, 2017.
  23. ^ "Equifax Hackers Stole Info on 693,665 UK Residents — Krebs on Security". krebsonsecurity.com. Retrieved October 11, 2017.
  24. ^ Staff; agencies (October 11, 2017). "Personal details of almost 700,000 Britons hacked in cyber-attack". Theguardian.com. Retrieved October 11, 2017.
  25. ^ "Equifax hack hit 694,000 UK customers". bbc.co.uk. October 10, 2017. Retrieved October 11, 2017.
  26. ^ "Equifax Breach Exposed Driver's License Data for 11 Million Americans". www.msn.com. Retrieved October 13, 2017.
  27. ^ Chin, Monica. "On top of everything else, Equifax hackers got 10 million driver's licenses". Mashable.com. Retrieved October 13, 2017.
  28. ^ "Equifax hackers took driver's license info on 10M Americans". Cnet.com. Retrieved October 13, 2017.
  29. ^ a b "Data from Equifax credit hack could "end up on the black market," expert warns". CBS News. February 11, 2020. Retrieved February 11, 2020.
  30. ^ Fazzini, Kate (February 13, 2020). "The great Equifax mystery: 17 months later, the stolen data has never been found, and experts are starting to suspect a spy scheme". CNBC. Retrieved February 11, 2020.
  31. ^ Mathews, Lee. "Equifax Data Breach Impacts 143 Million Americans". Forbes. Retrieved 2019-08-28.
  32. ^ "The end of the cloud is coming", VentureBeat, Victor Charypar, November 4, 2017
  33. ^ a b Melin, Anders (September 7, 2017). "Three Equifax Managers Sold Stock Before Cyber Hack Revealed". Bloomberg.com. Retrieved September 8, 2017.
  34. ^ "A Guide to Surviving the Equifax Data Breach". CNET. Retrieved September 12, 2017.
  35. ^ Lieber, Ron (September 10, 2017). "After Equifax Breach, Here's Your Next Worry: Weak PINs". The New York Times. Retrieved September 12, 2017.
  36. ^ "How to freeze your credit after a data breach". The Verge. Retrieved September 12, 2017.
  37. ^ Fung, Brian (September 9, 2017). "After the Equifax breach, here's how to freeze your credit to protect your identity". Washington Post.
  38. ^ Shaban, Hamza (September 15, 2017). "Two Equifax executives will retire following massive data breach". Washington Post. ISSN 0190-8286. Retrieved September 17, 2017.
  39. ^ Levin, Bess. "Equifax Lobbied to Gut Regulations Right Before Getting Hacked". Vanityfair.com.
  40. ^ "Equifax Inc Contributions to Federal Candidates, 2016 cycle". Opensecrets.org.
  41. ^ a b c Weisbaum, Herb, “Republicans in Congress Want to Roll Back Regulations on Credit Bureaus”, NBC News, September 11, 2017, Retrieved September 18, 2017
  42. ^ Lazarus, David (September 19, 2017). "Despite Equifax hack, GOP lawmakers want to deregulate credit agencies". Los Angeles Times. Retrieved September 20, 2017.
  43. ^ "New Equifax CEO offers "sincere and total apology" to consumers". September 28, 2017. Retrieved October 20, 2017.
  44. ^ a b Mills, Chris (September 8, 2017). "Equifax is already facing the largest class-action in history". bgr.com. Retrieved September 8, 2017.
  45. ^ Thadani, Trisha (September 13, 2017). "Lawsuit against Equifax filed in federal court in San Jose". SFGate.com. Retrieved September 13, 2017.
  46. ^ "People are taking Equifax to small-claims court — and winning". finance.yahoo.com.
  47. ^ Patrick Rucker, “U.S. consumer protection official puts Equifax probe on ice”, Reuters, February 5, 2018, Retrieved February 16, 2018
  48. ^ Stewart, Emily (February 7, 2018). "Elizabeth Warren warns Equifax could "wiggle off the hook" for users' credit data getting hacked". Vox. Retrieved February 16, 2018.
  49. ^ "Equifax to Pay $575 Million as Part of Settlement with FTC, CFPB, and States Related to 2017 Data Breach". Federal Trade Commission. 2019-07-19. Retrieved 2019-07-25.
  50. ^ "Equifax Data Breach Settlement". Federal Trade Commission. 2019-07-11. Retrieved 2019-07-25.
  51. ^ Benner, Katie (February 10, 2020). "U.S. Charges Chinese Military Officers in 2017 Equifax Hacking". The New York Times. Retrieved February 10, 2020.
  52. ^ Mariam, Baksh. "Chinese Military Officers Hacked Equifax, Justice Department Says". www.defenseone.com. Defense One. Retrieved 25 February 2020.
  53. ^ "6 Unanswered Questions For Equifax After A Massive Data Breach Of 143-Million Americans' Personal Information". September 8, 2017. Retrieved September 8, 2017.
  54. ^ "Cybersecurity Incident & Important Consumer Information". equifaxsecurity2017.com. Equifax. 2017. Retrieved September 13, 2017.
  55. ^ Melin, Anders (September 7, 2017). "Three Equifax Managers Sold Stock Before Cyber Hack Revealed". Bloomberg. Retrieved September 7, 2017.
  56. ^ Solon, Olivia (September 7, 2017). "Credit firm Equifax says 143m Americans' social security numbers exposed in hack". The Guardian. Retrieved September 11, 2017..
  57. ^ Morley, Katie (September 8, 2017). "Equifax hack: 44 million Britons' personal details feared stolen in major US data breach". The Daily Telegraph. Retrieved September 9, 2017.
  58. ^ "Equifax Stock Sales Are the Focus of U.S. Criminal Probe". Bloomberg.com. September 18, 2017. Retrieved September 18, 2017.
  59. ^ Bahney, Anna. "6 Equifax hack rumors fact-checked". CNNMoney. Retrieved September 12, 2017.
  60. ^ "Why the Equifax breach is very possibly the worst leak of personal info ever". CNBC. Retrieved 10 September 2017.
  61. ^ a b "Equifax's hack checker is a hot mess -- here's what to do". Cnet.com. Retrieved September 10, 2017.
  62. ^ Krebs, Brian. "Equifax or Equiphish? — Krebs on Security". krebsonsecurity.com. Retrieved October 13, 2017.
  63. ^ Chacos, Brad (September 8, 2017). "Equifax hack: How to know if you're affected". PCWorld. Retrieved September 13, 2017.
  64. ^ a b Robertson, Adi (September 8, 2017). "Can you join a class action suit if you use Equifax's free identity theft protection?". The Verge.
  65. ^ Mosendz, Polly; Nasiripour, Shahien (September 8, 2017). "Equifax's Hacking Nightmare Gets Even Worse For Victims". Bloomberg.com. Retrieved September 13, 2017.
  66. ^ Fung, Brian (September 8, 2017). "By signing up on Equifax's help site, you risk giving up your legal rights". chicagotribune.com. Retrieved September 13, 2017.
  67. ^ a b c d "Equifax finally responds to swirling concerns over consumers' legal rights". The Washington Post. Retrieved September 8, 2017.
  68. ^ Equifax. "Frequently Asked Questions - Cybersecurity Incident & Important Consumer Information | Equifax". 2017 Cybersecurity Incident & Important Consumer Information. Retrieved 16 February 2018. When were the Terms of Use for TrustedID Premier updated? ... We updated the Equifax product Terms of Use on www.equifax.com on September 12, 2017 to state that those terms do not apply to the TrustedID Premier product or the cybersecurity incident
  69. ^ Equifax (September 12, 2017). "Terms of Use". equifax.com. Archived from the original on September 15, 2017. Retrieved 16 February 2018.
  70. ^ "What Equifax owes us all: A free credit freeze at all agencies, for starters, and loads of answers". New York Daily News. September 12, 2017. Retrieved September 13, 2017.
  71. ^ Kirsch, Melissa (September 12, 2017). "Equifax Is Waiving Their Credit-Freeze Fees for 30 Days". lifehacker. Retrieved September 13, 2017.
  72. ^ Astor, Maggie (September 20, 2017). "Someone Made a Fake Equifax Site. Then Equifax Linked to It". The New York Times. ISSN 0362-4331. Retrieved September 21, 2017.
  73. ^ "Equifax sends breach victims to fake notification site". Ars Technica. Retrieved September 21, 2017.
  74. ^ Morse, Jack. "Equifax has been directing victims to a fake phishing site for weeks". Mashable. Retrieved September 21, 2017.