Equifax: 143 Million Records

There is a number that is spreading through the news this week, and the number is 143 million: the Americans whose personal data was exposed, the consumers whose names and Social Security numbers are now in the hands of criminals, the breach that Equifax disclosed on September 7 and that the country has been digesting ever since. The number is the September story, and the story is the lesson: the credit bureau that holds the records on nearly every adult in the country, the vulnerability that was known and never patched, the data that cannot be returned. Equifax disclosed the intrusion on the seventh, the stock fell through the week, and the questions grew by the day.

The breach is the subject of this article: how the attackers got in, why the company took so long to notice, and what the episode teaches about security leadership.

1. The Disclosure and the Number

The disclosure is the event, and the event is September 7: the announcement that Equifax made to the public, the intrusion that it described, the number that it put on the table. The number is the scale: 143 million United States consumers whose information was accessed, plus the customers in the United Kingdom and Canada, plus the records that keep growing. The disclosure is the shock: the company that most Americans had never heard of, the bureau that quietly keeps the files, the name that became a headline overnight.

The disclosure is also the market, and the market is the judgment: the stock that fell about 18 percent in the days after the announcement, the market value that dropped by roughly five billion dollars, the investors who sold and the analysts who cut their estimates. The disclosure is the September 13 reality: the regulators who are asking questions, the customers who are checking their credit reports for the first time, the trust that evaporated in a week. The disclosure is also the timeline: the weeks between the discovery and the announcement, the days that the insiders knew, the calendar that the lawyers are mapping.

2. What Was Taken

The data is the core, and the core is the personal: the names of the consumers, the Social Security numbers that cannot be changed, the birth dates and the addresses that anchor the identity, the driver's license numbers that were taken in some cases. The data is the permanent: the credit card numbers that can be cancelled and replaced, the 209,000 cards that were exposed, the dispute documents with personal details for about 182,000 people, the identity that cannot be reissued like a card. The data is also the breadth: the files that cover the adults and the children, the records that were compiled without consent and guarded without success.

The data is also the economics, and the economics is the crime: the Social Security number that is the key to the credit system, the fraud that can be committed in someone else's name, the accounts that can be opened and the loans that can be taken out. The data is the September worry: the consumers who do not know if they were hit, the credit freezes that are being requested, the monitoring that is being offered. The data is also the permanence: the stolen identity that surfaces years later, the vigilance that becomes a way of life. The data that was taken was the treasure, and the treasure was the target.

3. How the Attackers Got In

The entry is the vulnerability, and the vulnerability is the software: the Apache Struts framework that runs the web applications, the flaw that is known as CVE-2017-5638, the patch that was released in March, the update that Equifax did not apply. The entry is the exploit: the attackers who used the known hole from mid-May through July, the access that they maintained for weeks, the data that they quietly pulled out. The entry is the failure: the patch that was available, the company that did not install it, the breach that was preventable.

The entry is also the pattern, and the pattern is the industry: the vulnerable servers that sit unpatched, the inventories that are incomplete, the teams that do not know what they run. The entry is the 2017 lesson: the breaches at the companies that ignored the updates, the attackers who are patient, the vulnerabilities that are catalogued and sold. The entry is also the warning: the patches that pile up in every company, the debt that grows with every release, the moment when the known becomes the exploited. The entry that the attackers found was the door, and the door was left open.

4. Why It Took So Long to Detect

The detection is the delay, and the delay is the months: the intrusion that began in mid-May, the access that continued through July, the discovery that came on July 29, the weeks that the attackers had inside. The detection is the gap: the security tools that did not catch the exfiltration, the traffic that looked normal, the databases that were copied without an alarm. The detection is the question: how the largest credit bureau in the country could lose the files and not know it.

The detection is also the norm, and the norm is the uncomfortable: the average breach that takes months to find, the attackers who are already out by the time the alarm sounds, the forensic teams that reconstruct what happened. The detection is the September 13 lesson: the monitoring that must be constant, the alerts that must be tested, the assumption that the network is already compromised. The detection is the uncomfortable truth: the alerts that were missed, the tools that were not tuned, the budget that was not enough. The delay that lasted for weeks was the failure, and the failure was the finding.

5. The Executive Stock Sales

The sales are the detail, and the detail is the timing: the three executives who sold shares in early August, the days after the breach was discovered on July 29, the chief information officer David Webb and the chief security officer Susan Mauldin and a third officer, the proceeds that totaled about 1.8 million dollars. The sales are the optics: the insiders who cashed out before the announcement, the disclosure that came on September 7 and 8, the questions about what they knew and when.

The sales are also the lesson, and the lesson is the governance: the trading windows that exist, the blackout periods that should follow a material discovery, the insider rules that are about information, not just intent. The sales are the September 13 context: the lawyers who are looking, the shareholders who are angry, the policies that every board should review. The sales are the reminder: the blackout that protects the company, the appearance that is as important as the fact. The sales that came after the discovery were the stain, and the stain was the story.

6. The Response

The response is the offer, and the offer is the monitoring: the TrustedID Premier product that Equifax is giving away, the one year of free credit monitoring, the identity protection that the company says will cover the affected consumers. The response is the glitch: the website that could not handle the traffic, the terms of service that asked users to waive arbitration rights, the pages that failed and the call centers that jammed. The response is also the pressure: the website that buckled under the demand, the irony that the security firm could not protect its own page.

The response is also the apology, and the apology is the television: the chief executive Richard Smith who went on the air on September 12, the regret that he expressed, the promise that the company would do better. The response is the September 13 reality: the trust that was lost, the brand that was damaged, the rebuilding that will take years. The apology is also the beginning: the promises that must be kept, the changes that must be made, the customers who will decide whether they believe. The response that Equifax offered was the first step, and the first step was not enough.

7. The Class Action Wave

The lawsuits are the consequence, and the consequence is the lawyers: the class actions that were filed within days, the firms that signed up the plaintiffs, the consumers who joined the claims, the courts that will sort it out. The lawsuits are the pattern: the breach that triggers the litigation, the damages that are argued, the settlements that come years later, the fees that the lawyers will seek. The lawsuits are also the math: the damages that are claimed per record, the exposure that runs into the billions, the insurance that will not cover it all.

The lawsuits are also the pressure, and the pressure is the change: the companies that watch the Equifax case, the general counsels who review the response plans, the boards that ask about cyber insurance and incident response. The lawsuits are the September 13 lesson: the breach that is also a legal event, the disclosure that starts the clock, the exposure that goes beyond the data. The lawsuits are the mirror: the breach that could happen to any company, the boards that are now asking the questions. The wave that is building now was the consequence, and the consequence was the cost.

8. Leadership Lessons About Security Responsibility

The lesson is the ownership, and the ownership is the top: the security that is not an IT problem, the risk that belongs to the chief executive and the board, the budget that must be adequate, the accountability that must be assigned. The lesson is the patching: the vulnerability that was known, the update that was available, the discipline that failed, the process that must be built so the failure cannot happen quietly. The lesson is the inventory: the servers that must be known, the software that must be tracked, the patch that must be applied before the exploit is published.

The lesson is also the perspective, and the perspective is the data: the companies that hold the records of millions, the responsibility that comes with the files, the breach that is not a matter of if but when, the preparation that is the only defense. The Equifax breach is the September story, and the story is the lesson: the number 143 million that will be remembered, the leadership that failed, the industry that must learn. The lesson is the trust: the business that is built on the data, the customers who grant the access, the care that is owed in return. The records cannot be returned, and the trust must be rebuilt.

Tags

#technology #leadership