Equifax was breached through an unpatched Apache Struts flaw in an internet-facing portal, and the intrusion ran 76 days partly because a traffic inspection certificate had expired. You would have caught it only if you can answer yes to four questions: do you know where a component runs, can you verify a patch landed, are monitors alive, and is access segmented?
What happened, in brief?
This summary follows the US House Oversight Committee's December 2018 report, with the GAO report as a cross check. It is about controls, not blame. Large organizations run into these gaps constantly.
On March 7, 2017, a critical flaw in Apache Struts was publicly disclosed. Equifax's threat management team emailed an alert to more than 400 people on March 9, asking owners to patch within 48 hours. The report says the vulnerable software in the dispute portal, a custom application, was not patched.
The attack began May 13, 2017. The attackers placed web shells, found a file holding unencrypted credentials, and used them to reach 48 databases outside the portal's own environment. Equifax announced the incident on September 7, 2017. The House report cites 143 million consumers affected, and GAO says at least 145.5 million individuals' data was accessed.
Which controls failed, and how would you test yours?
1. Do you know where the component runs? Equifax ran an open source scan after the alert. The report quotes the interim security chief saying it missed the flaw because it ran against a root directory, not the subdirectory that held Struts.
Test: pick a library from your last advisory. Find every place it runs in under a day, including nested paths, containers and vendor products. If it takes a week, inventory is your first project.
2. Can you prove the patch landed? A second scan on March 15 checked 958 external IP addresses and found nothing. The House report concludes both scanning tools failed to identify vulnerable versions.
Test: for the last critical patch, who verified it, and how? A closed ticket is not verification. A rescan that finds the old version gone is.
3. Is the alert reaching the right owner? The alert went out through a mailing list. Owners had to recognize themselves in it.
Test: map each system to a named owner and send a drill advisory. Count how many acknowledge within the policy window.
4. Are your monitors alive? The device inspecting network traffic for the portal had an expired certificate, and the House report says it had been inactive for 19 months. GAO's report gives a different duration for this certificate, ten months, so treat the exact figure with care. When Equifax renewed it on July 29, 2017, suspicious traffic appeared almost immediately.
Test: list every certificate that your security tools depend on. Alert on expiry, and alert when a sensor sees zero traffic.
5. Is access segmented? The portal needed three databases, but was not separated from others. Credentials in a file opened 48.
Test: for one internet-facing app, list every database its credentials can reach. Anything beyond what it needs is a finding. Search config shares for plaintext passwords.
6. Can you spot data leaving? The attackers ran about 9,000 queries across those databases, and the data left unnoticed.
Test: do you alert on unusual query volume and large outbound transfers from your most sensitive stores?
What to do
- Build a component inventory that covers nested paths, images and vendor software.
- Verify every critical patch with a rescan, not a ticket status.
- Name an owner per system and drill advisory delivery.
- Track certificate expiry for all security tooling, and alert on silent sensors.
- Limit each application's credentials to the data it needs.
- Remove plaintext credentials from files and shares.
- Alert on bulk queries and outbound transfers from sensitive databases.
- Run a tabletop on a 48 hour patch deadline and see what breaks.
Quick check
Was the breach only about one missed patch?
No. The patch was the way in. The House report also points to failed scans, an expired certificate, flat access and unencrypted credentials, which let the intrusion go on for 76 days.
Do these controls still matter?
Yes, as a baseline. Inventory, patch verification, working monitors and limited credentials are basic hygiene, and checking them costs far less than finding the gap during an incident.
Sources
- US House Oversight Committee, The Equifax Data Breach (December 2018)
- US GAO, GAO-18-559, Data Protection: Actions Taken by Equifax and Federal Agencies
Last reviewed: 18 October 2026.
