Equifax breach timeline and what defenders should learn

The 2017 Equifax breach started with a known, patchable flaw in Apache Struts that was never fixed on one internet facing system. Attackers entered on 13 May 2017 and stayed 76 days, reaching 48 unrelated databases. The FTC says about 147 million people were affected. The lessons are about inventory, patch verification, segmentation and monitoring.

All facts below come from the US House Oversight Committee's majority staff report, the Government Accountability Office and the FTC. Where those sources differ, we say so.

What was the timeline?

• 7 March 2017: The Apache Struts project announced CVE-2017-5638 and released a patch.
• 8 March: US-CERT alerted Equifax to the need to patch.
• 9 March: Equifax's threat and vulnerability management team emailed the alert internally. The message said exploits were available, rated the issue critical and required patching within 48 hours under policy.
• 10 March: Mandiant, the firm Equifax later hired, found the first evidence of the flaw being exploited on servers connected to Equifax's network.
• 15 March: Equifax ran an open source component scan. It found no vulnerable Struts on externally facing systems. The interim chief security officer later said the scan was run on the root directory, not the subdirectory where Struts was listed.
• 13 May: Attackers entered through the Automated Consumer Interview System, a custom consumer dispute portal, and dropped web shells.
• 13 May to 30 July: The unauthorized access continued. The House report says attackers made about 9,000 queries across 48 databases.
• 29 July: Equifax renewed a security certificate on the device that monitored traffic for that system. The certificate had been expired for 19 months. Suspicious traffic was seen almost at once.
• 30 July: Equifax took the portal offline.
• September 2017: The FTC says Equifax announced the breach.

GAO says system administrators found the access in July 2017 through the online dispute portal.

How many people were affected?

GAO's highlights say at least 145.5 million people had personal information accessed, and its summary says nearly 150 million. The FTC says 147 million. The FTC's 2019 settlement announcement adds that attackers accessed at least 147 million names and dates of birth, 145.5 million Social Security numbers and 209,000 payment card numbers with expiration dates. The figures differ by source and date, so cite the source you use.

What went wrong, according to the sources?

The FTC alleged that Equifax:

• Was told to patch within 48 hours but nobody followed up to confirm it happened.
• Did not segment its database servers, so one breached database could expose other parts of the network.
• Stored credentials and Social Security numbers in plain text.
• Did not install robust intrusion detection for legacy databases.
• Had no policy ensuring security vulnerabilities were patched, per the FTC's allegation.

The House report adds that attackers found a file of unencrypted credentials, which let them reach databases outside the original system. GAO groups the failures into four factors: identification, detection, segmenting access to databases and data governance.

What was the outcome?

Equifax agreed to a global settlement with the FTC, the Consumer Financial Protection Bureau and 50 states and territories of at least 575 million dollars, potentially up to 700 million. The FTC's refund page describes it as including up to 425 million dollars to help affected people. Those figures describe different parts of the same settlement.

What should defenders learn?

Patching is a closed loop. Sending an alert is not patching. Someone has to verify that the fix landed, on every system.

You need an accurate inventory. The scan missed Struts because of where it looked. Know which software components run where, including nested directories and legacy systems. A current software bill of materials helps here.

Monitoring needs monitoring. A traffic inspection device that sat blind for 19 months turned a break in into a long exfiltration.

Segment and protect credentials. One stolen file of passwords opened 48 databases.

Be careful what you promise. The FTC contrasted Equifax's privacy policy language about reasonable safeguards with what it alleged.

What to do

1. Pick your five most exposed applications and confirm each one's component list.
2. For every critical advisory, record who patched what, and verify with a rescan.
3. Check that scans cover subdirectories, containers and legacy hosts.
4. Alert if a security monitoring device stops reporting or its certificate nears expiry.
5. Split database access by app, and remove plain text credentials from files.
6. Rehearse your first 48 hours for a critical dependency flaw.

Quick check

Sources

• House Oversight Committee, The Equifax Data Breach, majority staff report
• GAO-18-559, Data Protection: Actions Taken by Equifax and Federal Agencies
• FTC, Equifax to pay at least 575 million dollars as part of settlement
• FTC, Equifax data breach settlement

Last reviewed: 18 October 2026.