The attack began as many do, with the attackers first conducting reconnaissance by scanning Equifax’s publicly accessible systems to look for any known vulnerabilities. The length of time it took before Equifax discovered the breach enabled the attackers to move around within the company’s systems for months, relatively unimpeded. While public disclosure of the Equifax data breach did not occur until September 2017, Equifax system administrators had in fact discovered the unauthorized access in July 2017 - months after the attackers first gained entry to the company’s servers in March 2017. The retrospective look at the breach provides insights into how the breach occurred and what types of controls and technologies might have helped prevent it.

Government Accountability Office (GAO) has released a 40-page report outlining what happened. 7, 2017, and details on the breach slowly trickled out for months afterwards. The breach was publicly disclosed on Sept. Security: Stay up-to-date on the latest in breaches, hacks, fixes and all those cybersecurity issues that keep you up at night.īlockchain Decoded: CNET looks at the tech powering bitcoin - and soon, too, a myriad services that will change your life.The Equifax data breach that exposed the sensitive personal information of more than 145 million consumers was one of the worst data breaches of recent years, both for the amount of information exposed and the ease with which hackers moved about the company’s systems. PT: Added details about the Equifax breach. 'In the past year, we have undertaken a host of security, operational and technological improvements,' an Equifax spokesperson said.įor affected consumers and many in Congress, those improvements haven't yet hit the mark. Its new CISO, Jamil Farshchi, has had experience cleaning up messes: He was called in after Home Depot suffered its own major breach in 2014. An Equifax spokesperson said the company has spent $200 million on cybersecurity over the last year. So far, the company has paid nothing in fines to the government.Įquifax argues that it's going through a complete shift to make sure a breach like 2017's never happens again. Mark Warner, a Democrat from Virginia, are looking to pass, Equifax would have paid at least $1.5 billion in penalties for the breach. Warren and Cummings said they've sent a letter to both agencies asking if they 'intend to hold Equifax accountable.'

While the Bureau of Consumer Financial Protection and the Federal Trade Commission have opened investigations into Equifax's breach, neither of them have taken any actions.

Lawmakers are still waiting for some action to be taken against Equifax. The GAO reviewed documents from Equifax as well as files from the company's cybersecurity consultant to figure out how the company was hacked and what credit-monitoring services should do to protect themselves. The report comes from the Government Accountability Office, the agency that provides auditing and investigative services for Congess. On the anniversary of Equifax's breach, lawmakers released a report ( PDF) detailing exactly how the credit-monitoring company was hacked. 'If the breach happened 10 years ago, consumers would have been shocked and demanded change – now they are more likely to be jaded and under the assumption that someone already has their personal data or has access to it,' Brian Vecci, a technical evangelist at Varonis, said in an email. It doesn't help that much of that early rage has subsided. 'I think we should use this committee's time to make a difference in the lives of the American people and live up to the commitments that this committee has made: provide protections for our consumers.' 'We've not done anything as well for the 148 million people that were impacted by Equifax,' said Lujan, a Democrat from New Mexico.

Equifax security ze credit