Equifax Data Breach: Before and After the 2017 Hack of 147 Million People

On July 29, 2017, an Equifax administrator fixed a lapsed certificate and saw web traffic that did not belong there. That moment is when the Equifax data breach finally came into view. The attackers had been inside since spring. They had found the gap only two days after a public warning about it, and the warning had sat unanswered for months.

This case study is built as a before-and-after comparison. For each weak point, you will see how things looked inside Equifax in 2017 and what the company, regulators and courts changed later. Here is what the post covers:

• A dated timeline from the first scan in March to the claims deadline in 2024
• How the Equifax hack worked, explained without exploit detail
• Why the official victim counts differ and which number to quote
• The settlement, fines, criminal charges and an insider-trading case
• Seven numbered data breach lessons for teams in Pakistan

What Was the Equifax Data Breach?

Equifax is one of the three large credit bureaus in the United States. A credit bureau collects records about how people borrow and repay, then sells reports to lenders. That makes it a store of the exact details a fraudster wants.

In the Equifax data breach of 2017, attackers took personal data on roughly half of American adults from Equifax systems. According to the U.S. Government Accountability Office (GAO) report on the breach, the stolen records included names, Social Security numbers, birth dates, addresses and, for many people, driver's license numbers. GAO adds that card numbers for about 209,000 consumers and dispute documents for about 182,000 consumers were also taken.

Not every record held every field. Some entries were incomplete, so one person might have lost a name and birth date while another also lost a license number. Still, a Social Security number plus a birth date is enough to open credit in someone's name. That is why this credit bureau data breach is still taught nine years later.

Equifax Data Breach Timeline, Month by Month

The dates below come from the GAO report unless another source is named. US dates are used because the key events happened in Atlanta. Pakistan is nine hours ahead of Atlanta in summer, so a late-evening alert there lands on the next morning here.

Look at the gaps. About two months passed between the first entry and the first theft. Then roughly 76 days passed, by GAO's count, before anyone noticed. If you count calendar days from May 13 to July 29 you get 77, so you may see either figure quoted.

How Did the Equifax Hack Work?

You do not need code to understand this attack. Think of it as four doors that should have been locked, opened one after another.

Door One: An Unpatched Public Web App

The online dispute portal let consumers challenge errors on their credit files. It ran on Apache Struts. The Apache Struts vulnerability disclosed in March let a remote attacker send a specially shaped request that made the server run commands. A fix was available. But the GAO report says an outdated internal mailing list meant the patch notice never reached the people who ran that system. A scan Equifax ran a week after the warning also missed the portal.

Door Two: Passwords Left in Plain Text

Once inside, the attackers found a store of usernames and passwords that were not encrypted. GAO says those credentials let them reach three databases tied to the portal and 48 unrelated databases. A single foothold became wide access because the network was not split into zones that blocked that movement.

Door Three: Quiet, Small Withdrawals

The US Department of Justice indictment announcement says the intruders ran about 9,000 queries. GAO notes that data left in small pieces over encrypted web connections, which looked much like normal traffic.

Door Four: A Blind Inspection Device

Equifax did have a tool that inspected encrypted traffic. Its digital certificate had expired, so the tool waved traffic through without looking. When staff renewed it in late July, the strange traffic showed up almost at once.

How long was the tool blind? GAO says the certificate had been expired for about 10 months. The House Oversight Committee report puts the gap at 19 months and says more than 300 certificates had lapsed, 79 of them on business-critical domains. The reports were written at different times and may have measured from different start points. The safe wording is "many months," with both sources cited.

Before and After: Equifax Security Side by Side

After the Equifax data breach, the company's own investigation grouped the failures into four areas, as summarized by GAO: identification, detection, segmentation and data governance. The table pairs each one with the changes Equifax reported to GAO. Keep in mind that GAO did not independently verify those changes.

Notice that none of the "after" column is exotic. Patch tracking, certificate renewal and network zones are everyday work. That is the main point of the comparison: the gap was in routine, not in rare skills.

How Many People Were Affected, and Why Do the Numbers Differ?

You will see at least four totals for the same event. They are not contradictions so much as snapshots taken at different times.

• 143 million: Equifax's first estimate on September 7, 2017, as recorded by House Oversight.
• 145.5 million: the revised US figure from October 2, 2017, reported by GAO, plus nearly 1 million people outside the US.
• About 147 million: the number used in the 2019 settlement by the Consumer Financial Protection Bureau (CFPB) and its partners.
• 148 million: the figure in the House Oversight report, which it describes as about 56 percent of American adults.

Why the drift? GAO explains that in March 2018 Equifax found another 2.4 million US consumers with exposed names and partial license details. It had not yet worked out how many overlapped with the earlier group. If you write about the Equifax data breach, quote "about 147 million" with the settlement as your source, and mention that other counts exist.

Outside the US, the UK was hit hardest. Infosecurity Magazine reported that the UK Information Commissioner's Office linked its penalty to 15 million UK individuals.

Who Does the US Say Did It, and How Sure Is That?

On February 10, 2020, the Justice Department announced a nine-count indictment from a grand jury in Atlanta. It names Wu Zhiyong, Wang Qian, Xu Ke and Liu Lei. The DOJ says all four belong to the 54th Research Institute of China's People's Liberation Army. The charges include computer fraud, economic espionage and wire fraud.

The DOJ says the group routed traffic through about 34 servers in nearly 20 countries to hide where it came from. It also says they took trade secrets, meaning Equifax's data compilations and database designs, along with personal data.

How sure can you be? Separate two things. It is confirmed that a formal US indictment exists and names these four men. It is an allegation that they did it. The DOJ itself says the defendants are presumed innocent until proven guilty. The release also does not say that any of the four has been arrested. So the fair wording is "the US government charged members of China's military," not "China hacked Equifax" as settled fact.

Fines, Settlements and an Insider Trading Case

The fallout from the Equifax data breach reached regulators, courts and the company's own staff.

The US Settlement

The Equifax settlement was announced on July 22, 2019. It involved the CFPB, the Federal Trade Commission and attorneys general from 48 states, Washington DC and Puerto Rico. It was worth up to $700 million in total. That included up to $425 million for consumers and a $100 million civil penalty paid to the CFPB. Affected people were offered at least 10 years of credit monitoring.

The FTC's Equifax settlement page says the claims deadline was January 22, 2024. It adds that free identity restoration remains open until January 2029, and that payments were still being sent in late 2024.

The UK Fine

The UK regulator fined Equifax Ltd £500,000 in September 2018. Infosecurity Magazine notes this was the maximum allowed under the Data Protection Act 1998. The regulator cited weak data retention, patching and audit practices.

A Former Executive Sent to Prison

The case also produced a criminal conviction inside the company. According to the US Attorney's Office for the Northern District of Georgia, Jun Ying sold his shares before the Equifax data breach was public. He was a former chief information officer of an Equifax business unit. He gained more than $480,000 on the sale. In June 2019 he was sentenced to four months in prison, a $55,000 fine and $117,117.61 in restitution.

Why Does an American Credit Bureau Breach Matter in Pakistan?

Pakistan has its own credit records. The State Bank of Pakistan's eCIB FAQ explains that its Electronic Credit Information Bureau has run since December 1992. Banks, microfinance banks and other lenders send it borrower records every month, and consumer reports are identified by CNIC. SBP has also licensed private credit bureaus under the Credit Bureau Act, 2015.

That means the same kind of data lost in the Equifax data breach exists here, tied to the CNIC rather than a Social Security number. A lender, a credit bureau, a telecom company or a payroll provider that stores CNICs with dates of birth faces the same four doors. You saw a local version of the card side of this risk in our case study of the 2018 Pakistan bank data breach.

For individuals, the practical lesson is about what attackers do after a leak. Stolen identity details are often used for loan fraud, SIM fraud and convincing phone scams. Suppose a caller recites your CNIC and birth date. That proves only that the data is out there. It does not prove the caller works for your bank.

Seven Data Breach Lessons for Teams and Students

These lessons from the Equifax data breach are aimed at defenders. Each one maps to a door from the earlier section.

1. Own your patch list. Good patch management starts with knowing every system that runs a given component. Keep that inventory current, and send alerts to a role, not to a person who may have left.
2. Verify the fix. After patching, scan again and confirm the version changed. A patch that was never confirmed is only a plan.
3. Treat internet-facing apps first. A public web form that reads sensitive data should be first in line when a serious flaw is announced. The OWASP Top 10 for 2025 covers outdated and vulnerable parts under its software supply chain category.
4. Never store credentials in plain text. Use a secrets manager or encrypted vault, and rotate passwords that may have been exposed.
5. Split the network. A web server should not be able to reach dozens of unrelated databases. Segmentation turns one breach into a small one.
6. Track certificate expiry like a bill. Put every certificate and its renewal date on a dashboard with alerts weeks ahead. An expired certificate on a monitoring tool is a blindfold.
7. Rehearse the public response. House Oversight found that Equifax's breach website and call centers were quickly overwhelmed. Plan who speaks, which site you use and how people check if they are affected before you need it.

Want to compare this with a crypto case? The Binance hack explained post shows a very different entry path with similar weak points in approvals and monitoring. The WannaCry ransomware case from the same year shows what a missed Windows patch did at a global scale.

Learning to Investigate Breaches Like Equifax at PSTA

Reading a report is one skill. Turning it into a timeline, a root-cause list and a fix plan is another, and that second skill is what employers test. PSTA's Cyber Security & Ethical Hacking course lasts 12 weeks and is designed for beginners, so you need computer confidence rather than security experience.

According to the course page, the syllabus opens with the CIA triad and basic risk thinking. From there it moves to the attacks you will see most often, then ethical hacking basics and network defense. Later modules take in malware, threat detection, cyber law and digital forensics.

In the labs you run vulnerability scans, set up firewalls and intrusion detection, and write incident reports with an evidence timeline. That last task has the same shape as the GAO report on the Equifax data breach.

You can join from any city through live online classes, or attend in person at the Abbottabad campus. If you later want the offensive side, the Advanced Ethical Hacking & Penetration Testing course is a three-month practical track. To plan exams around either one, read the PSTA guide comparing cyber security certifications for beginners.

A Fifteen-Minute Certificate Check

Do you look after a website or office server? Open your hosting panel or monitoring tool today and list every certificate with its expiry date. Mark anything due within 30 days and set a reminder. It is a small task, and it closes the exact gap that kept Equifax blind for months.

Questions about where to start in security, or about class timings? You can message the PSTA team on WhatsApp from the course page whenever it suits you.