Equifax data breach FAQ: What happened, who was affected, what was the impact?

In 2017, attackers exfiltrated hundreds of millions of customer records from the credit reporting agency. Here's a timeline of the security lapses that allowed the breach to happen and the company's response.

1 2 Page 2
Page 2 of 2

More cash is available if you've actually lost money from identity theft or spent significant amounts of time dealing with the fallout, but here, too, documentation is required. And that $125 is just a maximum; it almost certainly will go down if too many people request checks.

What are the lessons learned from the Equifax breach?

If we wanted to make a case study of the Equifax breach, what lessons would we pull from it? These seem to be the big ones:

  • Get the basics right. No network is invulnerable. But Equifax was breached because it failed to patch a basic vulnerability, despite having procedures in place to make sure such patches were applied promptly. And huge amounts of data was exfiltrated unnoticed because someone neglected to renew a security certificate. Equifax had spent millions on security gear, but it was poorly implemented and managed.
  • Silos are defensible. Once the attackers were inside the perimeter, they were able to move from machine to machine and database to database. If they had been restricted to a single machine, the damage would've been much less.
  • Data governance is key — especially if data is your business. Equifax's databases could've been stingier in giving up their contents. For instance, users should only be given access to database content on a "need to know basis"; giving general access to any "trusted" users means that an attacker can seize control of those user accounts and run wild. And systems need to keep an eye out for weird behavior; the attackers executed up to 9,000 database queries very rapidly, which should've been a red flag.

Copyright © 2020 IDG Communications, Inc.

1 2 Page 2
Page 2 of 2
The 10 most powerful cybersecurity companies