Research Library

Equifax Data Breach 2017: What Happened

Between May and July 2017, attackers took personal data on 147.9 million Americans from Equifax, one of the three major US credit bureaus. The cause was not a new, unknown flaw — it was a known vulnerability left unpatched. This case study covers only confirmed facts, attributed and dated.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

What happened, in brief

Equifax is one of the three major consumer credit reporting agencies in the United States. It holds detailed financial records on nearly every adult American, most of whom never chose to be its customers — lenders and creditors supply the data. Between May and July 2017, attackers accessed Equifax's systems and took personal data on 147.9 million Americans, plus about 15.2 million people in the UK and about 19,000 in Canada. Equifax discovered the intrusion at the end of July 2017 and disclosed it publicly on 7 September 2017. The figures are as reported in the public record and the settlement documents; the US total was revised upward from the initial estimate as the investigation continued.

Timeline of confirmed events

7 March 2017: Apache publicly discloses CVE-2017-5638, a critical remote-code-execution flaw in the Apache Struts web framework, and a patch is released.
Mid-May 2017: attackers begin exploiting the unpatched flaw on Equifax's Automated Consumer Interview System (ACIS) dispute portal. The intrusion runs from May into July 2017.
29 July 2017: Equifax discovers the intrusion after renewing an expired internal security certificate, which restores monitoring that had been blind. The attackers had been inside for about 76–78 days by the various published counts.
7 September 2017: Equifax publicly discloses the breach, initially reporting more than 140 million Americans affected.
October 2017 and March 2018: Equifax reports additional affected records — 2.5 million and then 2.4 million — bringing the US total to 147.9 million.
December 2018: the US House Committee on Oversight and Government Reform concludes its investigation, finding the breach was preventable.
22 July 2019: Equifax agrees to a global settlement with the FTC, the CFPB and 48 states plus Washington, D.C. and Puerto Rico, announced as up to $700 million.
10 February 2020: the US Department of Justice indicts four members of China's People's Liberation Army, alleging they carried out the intrusion.

The technical cause: a known flaw, unpatched

The intrusion began with CVE-2017-5638, a critical vulnerability in Apache Struts that allowed an attacker to run commands remotely on an unpatched system. The flaw was public, the patch was public, and the vulnerability was disclosed on 7 March 2017 — months before the attackers used it. Equifax's dispute portal had not been updated. Once inside, the attackers moved through Equifax's systems and extracted data over a period of weeks. The intrusion went undetected in part because an internal network-monitoring certificate had expired, leaving the monitoring tool blind to the traffic leaving the network — a failure documented in the US Government Accountability Office investigation and in congressional findings.

The congressional investigation concluded the breach was preventable, and catalogued a series of basic failures: the unpatched known flaw, the expired certificate, credentials stored in plain text, and an unsegmented internal network that let the attackers move freely once inside. None of these required advanced techniques to exploit. That is the central lesson of the case: the most consequential breach in the record at the time was caused by failing to do the basics, not by a novel attack.

What was taken

For most affected people, the data included names, Social Security numbers, dates of birth, addresses, and in some cases driver's licence numbers. Payment card numbers for more than 200,000 people were also accessed, according to the settlement record. The damage is lasting because most of the data — above all Social Security numbers — cannot be changed. A password can be reset; a Social Security number follows a person for life, which is why this breach remains a reference case for identity-theft risk years later.

Attribution: what is confirmed and what is alleged

On 10 February 2020 the US Department of Justice indicted four individuals it identified as members of China's People's Liberation Army — Wu Zhiyong, Wang Qian, Xu Ke and Liu Lei — alleging they carried out the Equifax intrusion. The Chinese government denied the allegations. This case study states the indictment as an indictment: it is a formal charge by the US government, reported widely, and it is not a court verdict. No other attribution is asserted here, and no details of the alleged operation beyond the public indictment are presented as fact.

The settlement and its aftermath

In July 2019 Equifax agreed to a global settlement with the FTC, the CFPB and attorneys general of the states and territories, announced as up to $700 million. The settlement included a fund for consumer compensation — initially described as $300 million, with a consumer fund of up to $425 million under the total — plus $175 million to the states and territories and $100 million to the CFPB, and a requirement to spend substantially on improving its information-security programme over five years. In practice, many claimants who chose a cash payment received far less than the $125 figure mentioned in early coverage, because claims far exceeded the capped cash fund — a point the FTC itself explained publicly. The claims deadline passed on 22 January 2024.

The breach also changed US consumer protection in a lasting way: free credit freezes became mandatory nationwide, where some states had previously charged fees for them. A credit freeze — which stops new credit being opened in your name — is now the single most recommended step for anyone whose permanent identifiers were exposed.

Lessons confirmed by the record

Patch known flaws promptly. A public patch for a critical flaw is a deadline, not a suggestion. The window between disclosure and exploitation is measured in days.
Monitoring must be monitored. An expired certificate silently disabled detection for months. Security tools need their own health checks.
Segment networks and protect credentials. Once inside, the attackers moved freely; segmentation and proper credential storage would have limited the damage.
Permanent identifiers need permanent protection. When data such as Social Security numbers is collected at scale, the duty of care is proportionate to the harm of its loss.
Disclose promptly and clearly. Equifax disclosed about six weeks after discovering the intrusion; the delay and the confusion of the early response became part of the story itself.

For the vulnerability behind this breach, see our CVE explainer, and for the patching workflow it illustrates, the 'should I patch first?' decision guide in the same article.

Sources

Last checked: 14 November 2026

Frequently asked questions

How many people were affected by the Equifax breach?

Equifax reported that data on 147.9 million Americans was accessed, along with about 15.2 million British citizens and about 19,000 Canadians. The US figure was revised upward twice after the initial disclosure as the investigation continued.

What caused the Equifax data breach?

Attackers exploited CVE-2017-5638, a critical flaw in the Apache Struts web framework, on Equifax's consumer dispute portal. The flaw and its patch had been public since 7 March 2017, months before the intrusion began.

What data was stolen in the Equifax breach?

Names, Social Security numbers, dates of birth, addresses and, in some cases, driver's licence numbers, plus payment card numbers for more than 200,000 people, according to the settlement record.

What happened to Equifax after the breach?

In July 2019 Equifax reached a global settlement with the FTC, the Consumer Financial Protection Bureau and state attorneys general, announced as up to $700 million, including a consumer compensation fund and requirements to improve its security programme.

Who was blamed for the Equifax hack?

In February 2020 the US Department of Justice indicted four members of China's People's Liberation Army, alleging they carried out the intrusion. The Chinese government denied the allegations, which remain allegations in the legal sense — the indictment is a charge, not a proven verdict in court.

What should I do if my data was in the Equifax breach?

Freeze your credit with the three major bureaus, use strong unique passwords with multi-factor authentication, watch for phishing that uses your breached details, and check the official settlement site for claim information. The claims deadline passed on 22 January 2024.