Equifax: a known flaw opens access to the identities of millions of people

Equifax holds data used to assess the financial situation of consumers. In 2017, an intrusion exposed the information of about 147 million people. Some are not customers who have consciously chosen to entrust this information to this company.

Authorities describe the exploitation of a known Apache Struts vulnerability in a web application. A patch had been released, but the affected system was not properly protected. The problem, therefore, does not necessarily require the discovery of a secret weakness unknown to everyone.

Once entered, attackers access other resources and extract data. The content includes names, dates of birth and identification numbers. It’s not just a theft of passwords that every victim could change in minutes.

The discovery of the suspicious traffic leads to the termination of the application concerned and an investigation. The public disclosure causes a crisis of trust and the intervention of consumer protection authorities. Monitoring and repair measures are organised as part of subsequent procedures.

In 2020, the U.S. justice system accused four members of the Chinese army of having participated in the operation. A charge is not a final judgment. The attribution must remain attached to this procedure, without inventing the final destination of each data stolen.

The case is a reminder that digital loot can survive piracy for a long time. You can replace a credit card; replacing your date of birth or your administrative history is another matter. The cost of the theft is not only what its authors would have resold.