CyphrQ
Menu

Equifax Data Breach Settlement: What Happened and What It Cost

The 2017 Equifax breach exposed data on about 147 million people. How attackers got in, what the 2019 settlement cost, and what to check in your estate.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Incident: May 201710 min read

The Equifax data breach settlement was announced on 22 July 2019: Equifax agreed to pay at least $575 million, and potentially up to $700 million, to the FTC, the CFPB and US states (FTC). The 2017 breach behind it affected approximately 147 million people. Attackers got in through a web application flaw that had a patch available months earlier.

That last point is why this case still matters. The vulnerability was known, the fix existed, and an internal order to apply it was given. Nobody checked that it had been done.

This article sets out what happened, what was taken, how the attackers got in, and what the settlement required, using only the regulators' and investigators' own documents. For security and IT teams, there's a technical section on the attack chain and the control failures, mapped to MITRE ATT&CK.

Case file

Field Value
Organisation Equifax Inc. (US consumer credit reporting agency)
Region North America (United States)
Breach date Mid-May to July 2017 (Equifax 8-K, SEC)
Disclosed 7 September 2017 (Equifax 8-K, SEC)
People affected Approximately 147 million (FTC)
Data types Names, dates of birth, Social Security numbers, addresses, some driver's licence numbers, payment card numbers, dispute documents (FTC; SEC)
Penalty/settlement At least $575 million, up to $700 million, including a $100 million CFPB civil money penalty (FTC; CFPB)
Regulator(s) FTC, CFPB, 48 US states, the District of Columbia and Puerto Rico
Status Settled July 2019. Claims closed 22 January 2024; the administrator continues to issue identity-theft and fraud benefits (FTC refunds page)

Equifax in 2017: what happened, and when?

The timeline, as the official documents give it:

  1. March 2017: Equifax was alerted to a critical vulnerability in software used by its online dispute portal. Its security team ordered the patch applied within 48 hours, but nobody followed up to confirm it was done (FTC).
  2. Mid-May to July 2017: attackers had unauthorised access (Equifax 8-K).
  3. 29 July 2017: Equifax discovered the unauthorised access (Equifax 8-K).
  4. 7 September 2017: Equifax announced the incident publicly, initially putting the number of affected US consumers at approximately 143 million (Equifax 8-K).
  5. 22 July 2019: the FTC, CFPB and states announced the settlement (CFPB).
  6. 2020: a federal grand jury in Atlanta returned a nine-count indictment against four members of China's People's Liberation Army, all tied to its 54th Research Institute (US Department of Justice; FBI).

So the patch was available in March, the attackers arrived in May, and they were found at the end of July. That gap of roughly two months between the alert and the intrusion is the window that a working patch process would have closed.

How many Equifax consumers were exposed, and which data?

The final official figure is approximately 147 million people (FTC; CFPB). The FTC breaks it down:

Data Count Source
Names and dates of birth At least 147 million FTC
Social Security numbers 145.5 million FTC
Payment card numbers and expiry dates 209,000 FTC
Dispute documents with personal information Approximately 182,000 US consumers Equifax 8-K

The 8-K also lists addresses and, in some cases, driver's licence numbers. The numbers moved as the investigation went on: 143 million at disclosure, about 147 million in the 2019 settlement. The US Government Accountability Office report says "at least 145.5 million individuals" (GAO-18-559), which matches the Social Security number count.

Why this mix matters: a name, date of birth and Social Security number together are what US lenders use to confirm identity. Unlike a password, you can't change them.

How did attackers get into Equifax?

Through an unpatched flaw in Apache Struts, an open-source framework for building Java web applications. The vulnerability is CVE-2017-5638. Its record says the Jakarta Multipart parser in Apache Struts 2 versions 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 mishandles errors during file uploads, which "allows remote attackers to execute arbitrary commands" via a crafted HTTP header. It was published on 11 March 2017, noted as exploited in the wild that month, and carries a CVSS 3.1 score of 9.8 (Critical) (CVE record).

The Department of Justice says the attackers exploited that vulnerability in the Struts software used by Equifax's online dispute portal, mapped the portal, and obtained login credentials to move further through the network (DOJ).

The FTC adds what made the next steps easy. The attackers found an unsecured file holding administrative credentials stored in plain text, and operated undetected for months. The FTC's list of failures includes no patch management policy, no segmentation of databases, weak intrusion detection on legacy databases, and plain-text storage of credentials and Social Security numbers (FTC).

In plain terms: one missed patch let them in. Missing internal walls and readable passwords let them reach far more than one system.

What was the Equifax settlement, and who imposed it?

Three sets of regulators acted together. The FTC brought claims under the FTC Act and the Gramm-Leach-Bliley Act's Safeguards Rule; the CFPB under the Consumer Financial Protection Act of 2010; and the states under their own laws (FTC; CFPB).

Component Amount Who receives it
Consumer fund $300 million, plus up to $125 million more if needed Affected consumers (out-of-pocket losses, time spent, credit or identity monitoring)
State payment $175 million 48 states, the District of Columbia and Puerto Rico
Civil money penalty $100 million CFPB
Total At least $575 million, potentially up to $700 million

Source for every row: FTC. The CFPB describes the consumer portion as "up to $425 million" and the whole as "up to $700 million in relief and penalties" (CFPB).

Cap versus amount paid. The $700 million is a ceiling, and $575 million is the guaranteed minimum. The FTC's refunds page does not state how much has actually been paid out. It says the claims deadline was 22 January 2024, that the administrator "has been sending out payments for out-of-pocket losses" and other cash benefits, and that prepaid cards with additional payments were due in November 2024 for people who had already received a payment (FTC refunds page). I found no official total paid, so I don't quote one.

Consumer relief beyond cash, per the CFPB: at least 10 years of free credit monitoring, at least seven years of free identity-restoration services, and up to six free Equifax credit reports a year for seven years starting 31 December 2019 (CFPB). The FTC's current page says affected people can get free identity restoration until January 2029, even without having filed a claim (FTC refunds page).

What changed at Equifax afterwards?

The settlement went beyond money. Under the FTC order, Equifax had to (FTC):

  • Designate an employee to oversee its information security programme.
  • Run annual security risk assessments and put safeguards in place.
  • Obtain annual certification of the programme from its board or a relevant board subcommittee.
  • Test and monitor the effectiveness of its safeguards.
  • Make sure service providers that access personal data have adequate safeguards.
  • Get third-party security assessments every two years.

Board certification is the notable one. It moves security from an IT matter to something directors sign their names to every year.

Congress looked hard at the case too. The House Oversight and Government Reform Committee's December 2018 staff report called the breach "entirely preventable", pointing to complex and outdated legacy IT systems and a lack of clear lines of authority in IT management (House Oversight Committee). GAO recorded that Equifax "reported that it took steps to mitigate" the factors its investigation identified (GAO-18-559).

Going deeper: for security and IT teams

Threat model. The DOJ attributes the intrusion to four members of the PLA's 54th Research Institute (DOJ). That is a patient, well-resourced attacker. But the entry point needed no special capability: a public CVE with a CVSS 9.8 score, exploitable over the network without authentication, on an internet-facing application (CVE-2017-5638). Any opportunistic scanner could have found the same hole.

Attack chain mapped to MITRE ATT&CK. Each step below is from the DOJ release or indictment and the FTC, mapped to a technique I checked on attack.mitre.org:

Stage What the official record says ATT&CK technique
Initial access Exploited Apache Struts in the online dispute portal (DOJ) T1190 Exploit Public-Facing Application
Persistence Uploaded multiple unauthorised web shells to an Equifax web server (DOJ indictment) T1505.003 Server Software Component: Web Shell
Credential access Found administrative credentials stored in plain text in an unsecured file (FTC) T1552.001 Unsecured Credentials: Credentials In Files
Discovery and collection Weeks of queries to learn the database structure and find personal data (DOJ) T1213 Data from Information Repositories
Staging Results stored in temporary files, compressed and divided (DOJ) T1560 Archive Collected Data
Blending in Encrypted channels inside the network to look like normal traffic (DOJ) T1573 Encrypted Channel
Hiding origin About 34 servers in nearly 20 countries (DOJ) T1090.003 Proxy: Multi-hop Proxy
Defence evasion Deleted compressed files and wiped log files daily (DOJ) T1070.004 Indicator Removal: File Deletion

Control failures, as the official reports name them.

  • Patch management. A 48-hour patch order with no verification, and no patch management policy (FTC). The failure was not the alert. It was the missing closed loop: asset inventory, confirmation scan, exception tracking. GAO's first factor, "identification", points the same way: you can't patch what you can't find (GAO-18-559).
  • Encrypted-traffic inspection and certificate hygiene. The House staff report found a failure to renew an expired digital certificate for 19 months, which left Equifax without visibility into data exfiltration during the attack, and that Equifax had allowed over 300 security certificates to expire (House Oversight Committee). An inspection device that can't decrypt is a device that sees nothing, and it fails silently.
  • Segmentation. No database segmentation, so access from one compromised portal reached many data stores (FTC). GAO lists "segmenting of access to databases" as a factor (GAO-18-559).
  • Detection. Weak intrusion detection on legacy databases (FTC), and an attacker who wiped logs daily.
  • Data governance. Credentials and Social Security numbers stored in plain text (FTC); GAO names "data governance" as the fourth factor.

Detection signals worth alerting on. For T1505.003: new or modified script files (for example .jsp) under web roots, and web server processes spawning shells or command interpreters. For T1213: unusual query volume or schema-discovery queries from application service accounts. For T1560 and T1070.004: archive creation on servers that don't normally create archives, followed by deletion. For T1573: outbound encrypted sessions your inspection layer could not decrypt, counted rather than ignored.

What to check in your own estate.

  1. Pull every internet-facing application and its framework versions. Check them against the CISA Known Exploited Vulnerabilities catalog and your own scanner, and confirm each critical patch with a re-scan, not a ticket status.
  2. Export every certificate on inspection devices, load balancers and proxies with its expiry date. Alert at 30 days, and treat an expired inspection certificate as a detection outage.
  3. Test whether an application server in your DMZ can open a database connection it has no business need for. If it can, segmentation is a diagram, not a control.
  4. Search code repositories, config files and file shares for plaintext credentials; move them to a secrets manager and rotate.
  5. Ship web, application and database logs off-host so an attacker who wipes local logs doesn't wipe your evidence.
  6. Ask who owns the patch for each critical system, by name of role. The House report's finding on unclear lines of authority is the organisational version of the same bug.

Key takeaways

  • The 2017 Equifax breach affected approximately 147 million people and exposed 145.5 million Social Security numbers (FTC).
  • Entry was through CVE-2017-5638 in Apache Struts, published in March 2017, two months before the intrusion began.
  • The 2019 settlement with the FTC, CFPB and states was at least $575 million and up to $700 million, including a $100 million CFPB penalty. No official total paid out has been published on the FTC's refunds page.
  • The patch order existed. What was missing was verification, segmentation, credential hygiene and working encrypted-traffic inspection.
  • The fix that would have mattered most is boring: confirm patches by scanning, track certificate expiry, and keep internet-facing apps away from your databases.

Sources