Equifax 2017: how one missed patch exposed 147 million people

Nabayn did not work on this incident. This is our analysis of what is on the public record, written so other organisations can learn from it.

In 2017, hackers stole personal data on about 147 million people from Equifax, a US credit reporting company. The striking part is how ordinary the causes were: a security update that did not get installed, and a follow-up that did not happen. None of this needed a large company’s resources to prevent.

What happened

According to the US Federal Trade Commission, Equifax was alerted in March 2017 to a critical security vulnerability affecting a database that handled consumers’ credit enquiries. Its security team ordered that vulnerable systems be patched within 48 hours, but the company did not follow up to make sure this was done.¹

Equifax did not discover the database was unpatched until July 2017, when its security team noticed suspicious traffic. Multiple hackers had used the vulnerability to get in, and found an unsecured file containing administrative credentials stored in plain text. Those credentials gave access to vast amounts of data.¹

The hackers stole at least 147 million names and dates of birth, 145.5 million Social Security numbers and 209,000 payment card numbers.¹

What allowed it

The FTC’s complaint alleged a set of basic failures, including no policy to ensure vulnerabilities were patched, database servers not segmented to stop access spreading, and weak intrusion detection on older databases.¹

The US Government Accountability Office reported that Equifax’s own investigation identified four major factors: identification, detection, segmenting of access to databases, and data governance.² In plain terms, they did not know what was vulnerable, did not notice the intruders, did not contain them and had not controlled the data well.

What followed

Equifax agreed to pay at least $575 million, and potentially up to $700 million, in a global settlement with the FTC, the Consumer Financial Protection Bureau and US states.¹ This included $300 million for a consumer fund, $175 million to states and territories and $100 million in civil penalties to the CFPB.¹ Payments to consumers were still being made years later, with the settlement administrator sending further payments in November 2024.³

What a small business can learn

You probably do not hold data on millions of people, but the same failure can appear on a much smaller scale. These are our suggestions.

An instruction is not an outcome. Equifax’s team gave the right order. Nobody checked that it had been carried out. When you ask someone to update a system, or to close off a leaver’s access, check that it has actually been done.

Know what you run. You cannot patch what you do not know about. Keep a simple list of your systems, websites, plugins and who looks after each one.

Turn on automatic updates wherever you can. Most small business systems allow it, and it removes the need to remember.

Never store passwords in plain text. A spreadsheet of logins, or a note on a shared drive, is exactly what an intruder hopes to find. Use a password manager.

Do not let one mistake open everything. Give staff and systems only the access they need, so that one stolen login does not expose every record.

Keep less data. Information you never collected cannot be stolen. Delete what you no longer need, as explained in our guide to UK GDPR basics.

For a practical starting point, see Cyber Essentials for small businesses.