EQUIFAX HAD PATCH, DIDN’T INSTALL IT
Fix was available two months before hackers stole info from credit-reporting agency
Hackers took advantage of an Equifax security vulnerability two months after an industry group discovered the coding flaw and shared a fix for it, raising questions about why the credit-reporting agency didn’t update its software successfully when the danger became known.
A week after Equifax revealed one of the largest breaches of consumers’ private financial data in history — 143 million consumers and access to credit-card data of 209,000 — the industry group that manages the open source software in which the hack occurred blamed Equifax.
“The Equifax data compromise was due to (Equifax’s) failure to install the security updates provided in a timely manner,” The Apache Foundation, which oversees the widely-used open source software, said in a statement Thursday.
Equifax told USA TODAY late Wednesday the criminals who gained access to its customer data exploited a website application vulnerability known as Apache Struts CVE-2017-5638.
The vulnerability was patched on March 7, the same day it was announced, The Apache Foundation said. Cybersecurity professionals who lend their free services to the project of opensource software — code that’s shared by major corporations and that’s tested and modified by developers working at hundreds of firms — had shared their discovery with the industry group, making the risk and fix known to any company using the software. Modifications were made on March 10, according to the National Vulnerability Database. “The Equifax data compromise was due to (Equifax’s) failure to install the security updates provided in a timely manner.”
The Apache Foundation, which oversees the open source software
But two months later, hackers took advantage of the vulnerability to enter the credit reporting agency’s systems: Equifax said the unauthorized access began in mid-May.
Equifax did not respond to a question Wednesday about whether the patches were applied, and if not, why not.
It should have have acted faster to successfully deal with the problem, other cybersecurity professionals said.
“A typical bank would have patched this critical vulnerability within a few days,” said Pravin Kothari, CEO of CipherCloud, a cloud security company.
Federal regulators are investigating whether Equifax is at fault. The Federal Trade Commission and the Consumer Financial Protection Bureau have said they’ve opened probes into the hack.
So far dozens of state attorneys general are investigating the breach, and on Tuesday Massachusetts Attorney General Maura Healey said she plans to sue the company for violating state consumer protection laws. More than 23 class-action lawsuits against the company have also been proposed.
Equifax shares fell 2.5% Thursday after news of the FTC probe and are down 33% since it revealed the hack.
Information potentially stolen, including Social Security numbers and dates of birth and names, could put people at risk of identity theft for the rest of their lives, credit experts warn.