The Equifax Breach — Anatomy of an Unpatched Vulnerability

On September 7th, Equifax — one of the three credit bureaus that hold detailed financial dossiers on most American adults — disclosed a breach affecting roughly 143 million US consumers. Names, Social Security numbers, birth dates, addresses, and for subsets of victims driver's license and credit card numbers. Most of the people affected never chose to be Equifax customers; the data was collected about them, not from them. As breaches go, it's hard to imagine a worse combination of scale and sensitivity.

Details are still emerging, congressional hearings are being scheduled, and some of what follows may be revised as the investigation unfolds — we'll hedge accordingly. But the outline that has emerged in the past two weeks is already clear enough to learn from, and the central fact is depressingly familiar: the door the attackers walked through had a lock available for months. Nobody turned the key.

What we know so far

Piecing together Equifax's statements and reporting to date:

• The entry point was a vulnerability in Apache Struts, a widely-used Java web framework — specifically CVE-2017-5638, which Equifax confirmed on September 13th.
• The patch predated the attack by about two months. The Struts fix shipped in early March. Equifax says unauthorized access began in mid-May and continued until it was discovered on July 29th.
• Discovery to disclosure took nearly six weeks — July 29th to September 7th — a gap the company will be answering questions about for a long time.
• The exploited flaw was no secret. CVE-2017-5638 was rated critical, proof-of-concept exploits circulated within days of the March disclosure, and scanning for vulnerable servers was widespread all spring. This wasn't an obscure bug quietly weaponized — it was one of the most actively exploited vulnerabilities of the year, with months of public warning.

If that pattern sounds familiar, it should — it's WannaCry's pattern with the nouns changed. Patch ships. Months pass. Disaster arrives through the unpatched gap. Different organizations, same failure.

Lesson one — you can't patch what you don't know you run

The Struts advisory went out in March to everyone. So why does a patch like this get missed? Usually not because anyone decided to skip it — because nobody realized it applied. Struts isn't an application you install; it's a framework buried inside applications, including vendor-supplied ones whose internals you've never seen. When the advisory says "Apache Struts," someone has to translate that into "which means our customer portal, the claims system, and that thing procurement bought in 2013."

That translation requires a software inventory — not a spreadsheet from two years ago, but a living answer to "where do we run X?" It's less glamorous than any security product and more valuable than most:

• Dependency manifests for the software you build — your composer.json, pom.xml, Gemfile and friends, kept somewhere queryable.
• Artifact scans for the software you deploy, because manifests lie and vendors bundle. Even a crude scan beats nothing:

# Where is Struts actually deployed on this host?
find / -name "*.jar" -o -name "*.war" 2>/dev/null \
  | xargs -I{} sh -c 'unzip -l "{}" 2>/dev/null | grep -q struts && echo {}'

• A named owner per application — when the next critical advisory lands, "who checks the customer portal?" should have a one-name answer.

The test of an inventory is response time: when a critical CVE drops, how long until you can say "we are exposed here, here, and here — and nowhere else"? Hours is good. Days is survivable. "We found another instance in week three" is how 143-million-record breaches happen.

Lesson two — critical CVEs need an SLA, not a backlog ticket

Ordinary patching can run on a calendar. But a critical, remotely-exploitable vulnerability in internet-facing software — especially one being actively exploited, as this one loudly was — is a different species and needs different rules, agreed before the fire:

• A defined clock. For actively-exploited critical flaws in exposed systems: days, not sprints. Some teams say 72 hours; pick a number you'll actually honor.
• Permission to be disruptive. The SLA is meaningless if any product owner can veto the maintenance window. That authority question is decided in advance or it's decided never.
• A feed someone reads. Vendor advisories, distro security lists, US-CERT. The Struts warning was everywhere in March — the failure mode isn't missing information, it's information with no assigned reader.
• Mitigation as a fallback. When patching truly must wait, WAF rules or disabling the vulnerable component buy time — as a tracked exception with an expiry date, not a quiet forever.

Lesson three — the quiet months are the scandal

By Equifax's own timeline, attackers were inside from mid-May to late July — roughly ten weeks — before anyone noticed. The initial exploitation is almost the least damning part; sooner or later something gets through everyone's perimeter. Ten silent weeks of exfiltration is the deeper failure, and it's worth asking about your own systems: if data started leaving tonight, what would notice? Egress volumes, query patterns, authentication anomalies, log review that a human or machine actually performs — mean time to detect deserves the same attention lavished on prevention, because it's the difference between an incident and a catastrophe.

Lesson four — practice the communication before you need it

Equifax's response has drawn nearly as much fury as the breach: a help site thrown up on a separate, unfamiliar domain that security tools flagged as suspicious-looking, overloaded call centers, days of confusion over terms-of-service language, and executives facing questions about stock sales made before disclosure. Whatever the investigations conclude, the communication chaos was plainly unrehearsed — and rehearsal is free:

• Draft the notice templates now, with the blanks marked, reviewed by legal on a calm Tuesday instead of a frantic midnight.
• Decide where updates get posted — a status page or security page on infrastructure and domains your customers already trust, not a fresh domain that looks like phishing.
• Run the tabletop drill. Two hours, once or twice a year: who decides, who writes, who talks to regulators, what's the disclosure clock. The gaps you find in the drill are the gaps reporters would have found for you.

The pattern is the lesson

Strip the specifics and Equifax is the same story as WannaCry in May: the vulnerability was known, the fix existed, the warnings were public, and the gap between fix-available and fix-applied is where everything burned. The defense isn't exotic — it's inventory, patch discipline, detection, and rehearsed communication. Unglamorous, all of it, which is exactly why it keeps being skipped.

CompleteStatus helps with the watching half of that discipline — continuous external monitoring of your sites, endpoints and certificates, so changes and failures surface as alerts within minutes instead of surprises within months. Create a free account and put the boring, essential vigilance on autopilot — then go make sure nothing in your stack is running a March version of anything.