Equifax Data Breach (Jul-Sep 2017)

Introduction

In September 2017, Equifax — one of the three major US credit-reporting agencies — disclosed that its systems had been breached between May and July of that year. The exposed data covered 147.9 million Americans: Social Security numbers, dates of birth, home addresses, and in some cases driver's licence numbers and payment card details. The breach was not the result of a novel attack. It exploited a known, patchable vulnerability in Apache Struts (CVE-2017-5638) for which a patch had been publicly available since 8 March 2017 — more than two months before the breach began.

The Equifax breach is catalogued here as a confirmed case of institutional negligence compounded by insider trading and delayed disclosure — not because it involves fabricated claims, but because the documented facts are themselves more damaging than most conspiracy theories about corporate misconduct.

The Vulnerability and the Patch

Apache Struts is a widely-used open-source web application framework. CVE-2017-5638, published in the National Vulnerability Database on 8 March 2017, described a remote code execution vulnerability that allowed attackers to execute arbitrary commands on a server via a malformed HTTP header. The US Computer Emergency Readiness Team (US-CERT) issued alerts the same day. Equifax's internal security team was notified of the required patch. The patch was not applied to all systems.

On 13 May 2017 — 66 days after the patch was available — attackers began exploiting the unpatched vulnerability in Equifax's ACIS (Automated Consumer Interview System) dispute portal. The breach continued for 78 days before Equifax's security team detected it on 29 July 2017.

The Disclosure Timeline

Equifax discovered the breach on 29 July 2017. It did not notify the public until 7 September 2017 — 40 days after discovery. During that 40-day window:

• Chief Financial Officer John Gamble sold $946,374 in shares on 1 August 2017
• President of US Information Solutions Joseph Loughran sold $584,099 in shares
• President of Workforce Solutions Rodolfo Ploder sold $250,458 in shares

The company initially attributed these sales to pre-arranged trading plans. The Department of Justice subsequently charged former CIO Jun Ying with insider trading for selling approximately $950,000 in options in August 2017 after learning the company whose systems were breached was Equifax. Ying was convicted in 2019 and sentenced to four months in prison. Former manager Sudhakar Bonthu was also charged; he pleaded guilty and was sentenced to eight months of home confinement.

Executive Accountability

CEO Richard Smith appeared before multiple congressional committees in early October 2017, testifying that the failure to patch was the result of a breakdown in Equifax's internal security patching process: a single individual had failed to implement the scan that would have identified the vulnerable system. Smith resigned on 26 September 2017. CIO David Webb and CSO Susan Mauldin resigned on 26 September 2017 as well.

Critics noted that Mauldin held degrees in music composition rather than information security — a detail that became a flashpoint in congressional hearings about the adequacy of Equifax's security leadership. Equifax disputed characterisations of Mauldin's qualifications as misleading.

The Settlement and Regulatory Response

In July 2019, Equifax settled with the Federal Trade Commission, the Consumer Financial Protection Bureau, and all 50 state attorneys general for $700 million — at the time the largest data-breach settlement in US history. The settlement included up to $425 million in consumer restitution, though actual per-consumer payouts were significantly lower than initially advertised due to the volume of claims. The FTC was criticised for the settlement terms.

What the Breach Confirmed

The Equifax breach is a confirmed case of institutional negligence — a known critical vulnerability, unpatched for over two months, on a system holding the financial identity data of almost half the US adult population. The subsequent insider trading by executives who sold stock with advance knowledge of the breach compounds the institutional failure with documented financial crime.

No fabricated claims are involved. The documented record is the story.

Verdict

Confirmed. Every major element — the unpatched CVE, the 78-day undetected breach, the 40-day delayed disclosure, the pre-disclosure stock sales, the insider trading charges and convictions — is documented in court records, congressional testimony, FTC filings, and contemporaneous journalism. The breach is one of the most consequential failures of corporate data stewardship in US history.

The GAO's Independent Audit

In August 2018, the Government Accountability Office — Congress's independent auditor — published GAO-18-559, "Data Protection: Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach." The report was publicly released on 7 September 2018, a year to the week after Equifax's original disclosure. GAO's investigators, working independently of both Equifax and the congressional committees, identified four distinct categories of failure rather than a single patching lapse: weaknesses in identification of the vulnerable system, weaknesses in detection of the intrusion once it began, inadequate segmentation of databases from one another, and weak data governance practices generally. GAO noted that the CFPB and FTC investigation was still open at the time of publication and explicitly declined to issue new recommendations, deferring to two follow-on reports on credit-reporting-agency oversight and consumer privacy. The GAO's contribution to the record is significant precisely because it is not an accountability document — it is a systems audit, and it found the patch failure was one symptom of a broader architectural problem, not an isolated human error.

The House Oversight Committee's Findings

Three months after the GAO report, on 10 December 2018, the majority staff of the House Committee on Oversight and Government Reform released its own report after a 14-month investigation that reviewed more than 122,000 pages of documents and interviewed current and former Equifax employees alongside Mandiant, the forensic firm Equifax had retained. The Committee's headline conclusion was that the breach was "entirely preventable." Two findings from that report go beyond what is already documented in this entry's main narrative. First, Equifax's intrusion-detection system had been unable to inspect encrypted traffic for 19 months because the digital certificate needed to decrypt and monitor that traffic had expired and was not renewed — meaning the attackers' exfiltration of data over 78 days occurred inside a blind spot Equifax itself had created and failed to notice. Second, the Committee found a structural governance defect: Equifax's Chief Security Officer reported not to the Chief Information Officer, the executive responsible for the systems the CSO was meant to secure, but to the company's legal department. The Committee described this as an accountability gap between the people who set security policy and the people who implemented it.

The 2020 Indictment: Naming Chinese Military Hackers

On 10 February 2020, the Department of Justice unsealed an indictment charging four members of China's People's Liberation Army — Wu Zhiyong, Wang Qian, Xu Ke, and Liu Lei — with the intrusion. All four were identified as members of the PLA's 54th Research Institute. The nine-count indictment alleged conspiracy to commit computer fraud, computer fraud and abuse with intentional damage to a protected computer, conspiracy to commit economic espionage, economic espionage, conspiracy to commit wire fraud, and wire fraud. Attorney General William Barr, announcing the charges, said the intrusion was "a deliberate and sweeping intrusion into the private information of the American people," and added that the stolen data "has economic value, and these thefts can feed China's development of artificial intelligence tools as well as the creation of intelligence-targeting packages." Investigators said they identified the four defendants through forensic analysis of the malware used and the attackers' infrastructure, despite the hackers' use of encrypted communications and traffic routed through servers in roughly 20 countries to obscure their tracks.

What the Indictment Does Not Prove

An indictment is a set of criminal charges, not a verdict. None of the four PLA officers has ever been in US custody, and officials acknowledged at the time of the announcement that there is little realistic prospect of any of them appearing in an American courtroom: the United States has no extradition treaty with China. The practical effect of the indictment is to put the defendants on notice that they risk arrest if they travel outside China, and to formally attribute the intrusion for diplomatic and legal purposes — not to subject the underlying evidence to adversarial testing in open court. Writing in Foreign Policy, Brookings fellow Robert Williams argued the broader US strategy of indicting state-linked hackers who will never be tried has a mixed record as deterrence: "China's state-sponsored cybertheft has not meaningfully diminished in response to the U.S. indictment campaign" since the practice began in 2014, he wrote, suggesting the indictments may serve legal or diplomatic purposes — such as laying groundwork for sanctions or offensive cyber responses — that are distinct from, and narrower than, stopping the underlying activity. This entry treats the PLA attribution as the official, charged US government position — supported by forensic investigation — while noting that it rests on prosecutorial allegation rather than a adversarially-tested criminal conviction, unlike the Jun Ying insider-trading case, which did result in a guilty plea.

Beijing's Denial

China's government rejected the accusation. The day after the indictment was unsealed, foreign ministry spokesperson Geng Shuang told reporters that China "firmly oppose[s] and combat[s] cyberattacks of any kind" and that "the Chinese government, military and relevant personnel never engage in cyber-theft of trade secrets," while turning the accusation back on Washington by citing the WikiLeaks and Snowden disclosures as evidence of American "hypocrisy and double standards." No independent, non-governmental forensic body has published a competing attribution; the denial is a diplomatic statement, not a rebuttal supported by published counter-evidence.

The Settlement's Contested Adequacy

The $700 million July 2019 settlement was widely reported as historic, but its consumer-facing terms drew sustained criticism. The FTC had advertised that affected consumers could choose a $125 cash payment in lieu of credit monitoring. Only $31 million was allocated to the cash-payment option. When far more than 31 million dollars' worth of consumers chose cash, the FTC walked the number back: deputy director Peter Kaplan said in July 2019 that payouts would be divided among all claimants and would likely be "nowhere near" $125 per person. Senator Elizabeth Warren asked the FTC's Inspector General to investigate the agency's own public statements as potentially misleading, and the consumer group Demand Progress called on the FTC to issue itself a cease-and-desist for what it called an empty promise. Separately, in December 2019 a federal court approved close to $80 million in fees for the consumer class-action attorneys in the parallel private litigation — a detail critics have cited when arguing the settlement's structure served litigants and lawyers more predictably than it served the 147 million people whose data was actually exposed.

Executive Compensation After the Breach

Richard Smith agreed to forgo his 2017 bonus, reportedly worth several million dollars. He was not, however, required to forfeit the bulk of his compensation: reporting after his departure put his retained stock and pension benefits at roughly $18–24 million, on top of lifetime medical coverage. Equifax's clawback policy at the time only applied to compensation tied to accounting fraud, not to losses stemming from a security failure or a regulatory settlement, so none of Smith's pay was clawed back. This is a governance detail rather than evidence of a conspiracy: it shows an incentive-structure gap that predates and is independent of the breach, and it applied automatically rather than through any documented decision to shield Smith specifically.

Distinguishing Insider Trading from a "Corporate Cover-Up"

It is worth being precise about what was and was not charged. Jun Ying and Sudhakar Bonthu were prosecuted and either convicted or pleaded guilty to personal insider-trading offenses — using material nonpublic information for individual financial gain. Neither the SEC nor the DOJ ever alleged, let alone charged, a board-authorized or company-wide scheme to conceal the breach for collective benefit; the three executives whose August 2017 stock sales drew scrutiny (CFO John Gamble, and division presidents Joseph Loughran and Rodolfo Ploder) were never charged criminally, and Equifax's own internal review concluded their sales were made under pre-existing trading plans. A version of this story that frames the stock sales as proof of an orchestrated corporate cover-up goes beyond what has been charged or proven; the version supported by the documented record is narrower — a company-wide security failure, compounded by two individual employees who used what they knew for personal profit, that in Ying's case was substantial enough to secure a criminal conviction.

What Remains Unresolved

Taken together, the GAO audit, the House Oversight report, the 2020 indictment, and the disputed settlement do not change the confirmed verdict on this breach — if anything they deepen the documented record of institutional failure. But they also mark the edges of what is actually proven: state attribution that rests on an untested indictment rather than a conviction, a settlement whose consumer remedy was mismatched to an espionage-motivated theft rather than a financially-motivated one, and individual criminal liability that stopped well short of the company's boardroom.