Equifax 2017: A Known Patch and an Expired Certificate
also called Equifax Breach
An unpatched framework vulnerability provided entry, and an expired certificate on a monitoring device meant the exfiltration went undetected for months.
What happened
In 2017 Equifax suffered a breach affecting the personal data of roughly 147 million people. Two failures combined, and the second is the one that made the first catastrophic.
Entry: a known vulnerability in Apache Struts, a widely-used web framework, for which a patch had been available for approximately two months. The affected system had not been patched.
Detection: the exfiltration continued undetected for around 76 days. A device used to inspect encrypted traffic had an expired certificate, so the traffic it was meant to inspect was passing uninspected. The certificate had reportedly been expired for a long period.
The architectural reading
Vulnerability management is an inventory problem before it is a patching problem. Patching a known CVE in a widely-used framework is straightforward; knowing which of hundreds of systems use it, at which version, and which are internet-facing is not — and without that inventory, patching is a survey conducted under time pressure.
This is precisely what an SBOM generated at build time and stored queryably across the estate provides, and why the requirement moved from good practice to procurement language after Log4Shell.
Detection controls decay silently. The inspection device did not report that it had stopped working; it simply stopped working. A control whose failure is invisible provides false assurance, which is worse than no control because it is relied upon.
The transferable lesson
Three things worth taking directly:
Maintain a queryable inventory of components across every deployed artifact, so "which systems ship this library at this version, and which are internet-facing" is a query rather than a project. Prioritise by exposure and reachability rather than by raw severity score.
Monitor your monitoring. Every detection control needs a heartbeat proving it is still operating — including certificate expiry on the devices that perform inspection, which belongs in the certificate inventory alongside everything else.
Measure time to remediate, not open finding count. The count is a function of the vulnerability database and rises regardless of your work; time to remediate measures the capability you are building.