The US Government Accountability Office reviewed the Equifax breach and named four major weaknesses: identification, detection, segmenting of database access, and data governance. The framing matters because many retellings reduce the incident to one missed patch. GAO's report treats it as a chain of failures, any one of which could have limited the damage.
The facts from GAO
GAO report GAO-18-559 says attackers gained unauthorised access over the internet to Equifax's online dispute portal, then reached the network and extracted personal data from databases. Equifax discovered the intrusion in July 2017. GAO states the breach involved access to at least 145.5 million individuals' personal information. The FTC's settlement page uses a figure of 147 million people, so sources differ slightly on the count.
For the vulnerability that was exploited, see the existing post on the Apache Struts flaw behind the Equifax breach.
1. Identification
This is about knowing what you run and what is wrong with it. An accurate inventory and a working process for matching vulnerabilities to systems come first. If a critical advisory arrives and nobody can say which systems are affected, the clock runs for the attacker.
Ask: can you list every internet facing application, its owner and its components within an hour?
2. Detection
Even when prevention fails, you want to notice quickly. Detection covers monitoring of traffic and activity that would reveal an intruder moving or exfiltrating data.
Ask: which signals would show a large outbound transfer from a database server, and who reviews them?
3. Segmenting of database access
A foothold on one web application should not provide a path to many databases. Segmentation limits what a compromised system can reach.
Ask: what can your public facing apps connect to, and is each connection justified and logged?
4. Data governance
Governance means knowing what sensitive data you hold, where it lives and why. Data you do not need, or do not know about, cannot be protected well.
Ask: do you have a current map of personal data stores, with retention rules that are actually applied?
According to the FTC, Equifax reached a global settlement with the FTC, the Consumer Financial Protection Bureau and 50 US states and territories, which includes up to 425 million dollars to help affected people. The FTC page also notes a 2019 press release headline citing 575 million dollars, and does not explain how the two figures relate, so quote them carefully.
Aftermath and using the four as a self-assessment
Score yourself from one to five on each. Fix the lowest one first, not the one that is easiest. Safeguard's asset discovery, dependency scanning and compliance evidence features map most directly to identification and governance.
Quick check
How many people were affected?
GAO says at least 145.5 million. The FTC page says 147 million. Cite the source you use.
Was the breach only about one unpatched flaw?
GAO identified four weaknesses: identification, detection, segmentation of database access and data governance.
Sources
Last reviewed: 19 October 2026.
