The Equifax Breach
Neil Daswani, Moudy Elbayadi · Apress eBooks · 2021
In September 2017, the largest financial identity breach of US consumers at its time was announced by Equifax. At the time of the breach, Equifax was one of the top three credit reporting agencies in the United States and a custodian of credit information for 820 million consumers and 91 million businesses. Over 145 million records were stolen by four suspected and later indicted Chinese hackers who were part of the Chinese People’s Liberation Army, a part of the Chinese armed forces. Table 4-1 shows the number of names, addresses, social security numbers, and dates of birth, among other sensitive data that were stolen. The breach was due to Equifax’s Automated Consumer Interview System (ACIS), which allowed consumers to dispute potentially incorrect information in their credit files. One root cause was a software vulnerability that was not patched, the details of which we will describe in this chapter.