In 2017 attackers breached credit bureau Equifax through an unpatched vulnerability in Apache Struts, exposing the personal data of around 147 million people, including names, dates of birth and Social Security numbers. It remains one of the most damaging identity data breaches because the stolen information is permanent and cannot simply be reset.

The Equifax breach remains one of the most significant cybersecurity incidents in history. While many large breaches involve usernames and passwords that can eventually be changed, the attackers who breached Equifax obtained information that people carry for life.

Names, dates of birth, Social Security numbers, driver’s licence details, and other identity records have lasting value because they can be used for identity theft, financial fraud, and social engineering years after the original breach.

The incident also became a textbook example of how failing to apply a known security patch can create consequences affecting millions of people.

What Happened and When

In 2017, attackers compromised systems operated by Equifax, one of the largest consumer credit reporting agencies in the United States.

The breach occurred between May and July 2017 before being discovered on 29 July 2017. Equifax publicly disclosed the incident on 7 September 2017, announcing that attackers had accessed the personal information of approximately 147 million people. The stolen information included names, dates of birth, Social Security numbers, addresses, and in some cases driver’s licence numbers and payment card information. According to the US Federal Trade Commission (FTC), the breach affected nearly half of the US population at the time.
Source: https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement | https://www.gao.gov/products/gao-18-559

Unlike many breaches that primarily expose login credentials, the Equifax incident compromised highly sensitive identity information that victims could not simply replace.

The Entry Point: An Unpatched Apache Struts Vulnerability

The attackers gained access by exploiting a vulnerability in Apache Struts, an open source web application framework widely used by enterprise applications.

The specific flaw, CVE-2017-5638, allowed remote code execution through vulnerable Apache Struts installations.

Apache released a security patch in March 2017, several months before attackers exploited the vulnerable Equifax system. Investigations later found that the affected internet-facing application had not been patched despite the availability of the fix.
Source: https://www.cisa.gov/news-events/alerts/2017/03/08/apache-struts-2-content-type-remote-code-execution-vulnerability | https://www.gao.gov/products/gao-18-559

Once attackers established access, they moved through internal systems and collected sensitive consumer information over several weeks before the activity was detected.

The breach demonstrated how a single internet-facing vulnerability can become the starting point for a major data compromise.

Why the Delay in Patching Mattered

Security patches exist to close known vulnerabilities before attackers exploit them.

In the Equifax case, the necessary update had already been released before the intrusion occurred.

The subsequent US Government Accountability Office (GAO) investigation found shortcomings in Equifax’s patch management and asset visibility processes, contributing to the failure to remediate the vulnerable system in time.
Source: https://www.gao.gov/products/gao-18-559

This highlights an important lesson for every organisation.

Cybersecurity is not only about discovering new threats. It also depends on consistently applying available security updates to internet-facing systems.

Attackers routinely scan the internet for known vulnerabilities after patches become public because organisations often take time to deploy them.

The longer critical vulnerabilities remain unpatched, the larger the opportunity for attackers.

The Impact

The Equifax breach had consequences that extended far beyond the initial compromise.

The exposed information included permanent identity records such as:

• Full names
• Dates of birth
• Social Security numbers
• Addresses
• Driver’s licence numbers
• Some payment card information

Unlike passwords, these identity attributes generally remain unchanged throughout a person’s life.

As a result, victims faced ongoing risks including:

• Identity theft
• Financial fraud
• Loan and credit application fraud
• Tax fraud
• Targeted phishing
• Social engineering

The financial consequences for Equifax were also substantial.

In 2019, Equifax agreed to a settlement with the FTC, Consumer Financial Protection Bureau, and US states and territories that included up to $425 million to help affected consumers, along with additional penalties and security commitments.
Source: https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement

The breach became one of the defining examples of how cybersecurity failures can create long-term legal, financial, and reputational consequences.

Why Identity Data Is Different From a Password

Passwords can usually be changed within minutes.

Identity information cannot.

Once criminals obtain permanent personal information, it may remain useful indefinitely.

Identity data can be combined with information from:

• Additional data breaches
• Phishing campaigns
• Public records
• Social media
• Infostealer malware

This enables attackers to build detailed victim profiles that support identity fraud and targeted attacks.

Criminals continue trading identity information through underground communities operating across Tor, Telegram and I2P, together with relevant forums and marketplaces.

Unlike stolen passwords, identity records often remain valuable for years because they continue to support fraud long after the original breach.

The Lesson: Monitoring for Exposed Identity Data and Acting on It

No organisation can completely prevent every data breach.

However, organisations can reduce risk by identifying exposed information early and responding quickly.

DarkThreatX supports organisations through dark web monitoring for financial services and personal dark web monitoring for individuals.

The platform continuously monitors 100B+ records across criminal intelligence sources, including activity across Tor, Telegram and I2P, together with relevant underground forums and marketplaces.

DarkThreatX also:

• Monitors 24/7
• Indexes more than 1 million new stealer logs every week
• Delivers alerts in under five minutes
• Reports zero false positives

Early visibility allows organisations and individuals to investigate exposed identities, strengthen authentication, monitor for fraud, and respond before additional criminal activity occurs.

While permanent identity information cannot be changed, understanding when it appears within criminal communities helps reduce the time between exposure and response.

Conclusion

The Equifax breach was not simply another large data breach.

It demonstrated how a known vulnerability, left unpatched, allowed attackers to obtain identity information belonging to approximately 147 million people.

The incident also reinforced an important distinction between passwords and identity records. Passwords can be reset. Personal identity information often cannot.

Prompt patch management, strong vulnerability management processes, continuous monitoring for exposed data, and rapid response remain essential for reducing the long-term impact of identity-focused breaches.

Frequently Asked Questions

How did the Equifax breach happen?

Attackers exploited an unpatched Apache Struts vulnerability on an internet-facing Equifax application. Although a security update had already been released, the vulnerable system remained unpatched, allowing attackers to gain access and steal sensitive personal information.

How many people were affected by the Equifax breach?

Approximately 147 million people were affected. The exposed information included names, dates of birth, Social Security numbers, addresses, driver’s licence numbers, and, for some individuals, payment card information and dispute documents.

Why was the Equifax breach so damaging?

The breach exposed permanent identity information rather than passwords alone. While passwords can be changed, information such as Social Security numbers and dates of birth generally cannot, creating long-term risks of identity theft and financial fraud.

What is the lesson from Equifax?

Organisations should apply security patches as soon as practical, maintain accurate visibility of internet-facing systems, and continuously monitor for exposed identity data. Rapid patching and early detection reduce the likelihood that attackers can exploit known vulnerabilities or misuse stolen information.