Year – 2017

Estimated Economic Losses – US$1.4 Billion+ in settlements, investigation, remediation, security improvements, and recovery costs

Systems Affected – Approximately 147 Million Individuals

Type of Attack – Web Application Exploitation | Massive Data Breach

Suspected Group / Organization – Four members of China’s People’s Liberation Army (PLA) were indicted by the U.S. Department of Justice in connection with the attack

Detailed Working
Attackers exploited an unpatched vulnerability in the Apache Struts web application framework to gain unauthorized access to Equifax systems. After establishing access, they navigated the network, accessed sensitive databases, and exfiltrated large amounts of personal information, including names, Social Security numbers, birth dates, addresses, and other sensitive data.