Equifax Data Breach: A Costly Cyber Failure

This presentation explores the 2017 Equifax data breach, one of the largest cybersecurity incidents in history. It covers how hackers exploited vulnerabilities to steal personal data from 147 million consumers, the aftermath of the breach, regulatory responses, and key lessons in data security, risk management, and ethical responsibility in the tech industry.

1. By: Cayce Evangelista
EQUIFAX DATA
BREACH - 2017

2. Learning
Objectives
EQUIFAX
BACKGROUND
INFORMATION
STOLEN
WHAT HAPPENED
EXACTLY?
01
02
03

3. 01 - Background
Information
Equifax is the company in
charge of monitoring your
credit
In 2017 Equifax had a data
breach which impacted
around... 147,700,000 Million
People

4. 02 - Information Stolen
Social Secuirty number
Customer's names
Addresses
Birthdates
Drivers license number
Credit card numbers
Source: https://epic.org/privacy/data-breach/equifax/

5. March 7, 2017: The Apache Software foundation released patch for its
Struts 2 vulnerability
Struts 2 is a framework used by companies to create a java web
applications
This vulnerability allowed attackers to send a HTTP request with
malicious code tucked in the content-type header
This allowed strut 2 to be tricked into running the code and lead to
opening the sytem it was running
March 8, 2017: The united states computer emergency readiness Team
(US-CERT) warned about the apache software's struts 2 vulnerability
This warning was given for companies to addres it
If they did not, then a remote attack could explot it
03 - What Exactly Happened?
Source: https://us-cert.cisa.gov/ncas/current-activity/2017/03/08/Apache-Software-Foundation-Releases-Security-Updates
https://www.cnet.com/news/equifaxs-hack-one-year-later-a-look-back-at-how-it-happened-and-whats-changed/

7. March 9, 2017: Equifax administrators were told to apply
patch but it wasn't done
March 10, 2017: Hackers were searching for servers that
contained this vulnerability and found Equifax's dispute portal
The hackers gained access to login credentials for 3 servers
May 13, 2017: Hackers began moving from these servers into
other parts of the network and taking data
With the credentials, they were able to access 48 more
servers
Continued...
Source: https://www.csoonline.com/article/3444488/equifax-data-breach-faq-what-happened-who-was-affected-what-
was-the-impact.html

8. Continued...
Until july 29, 2017: Hackers stole data
They stole the data by encrypting the data while moving it so they
would not be noticed
Equifax had tools that were used to decrypt analyze, and re-encrypt
network traffic using a public-key certificate
Equifax had failed to renew their certificate; the traffic wasn't getting
inspected
Only when they renewed it on this july 29, it is when they noticed
Septemberr 8, 2018: after internal investigation, the public was let know
of the breach
After the breach, no identity theft occurred as it is believed to be chinese
state-sponsoredhack
Source: https://www.csoonline.com/article/3444488/equifax-data-breach-faq-what-happened-who-was-affected-what-
was-the-impact.html

9. How Attackers Exploited Vulnerabilities in the 2017 Breach, Based on
Equifax Information

10. Equifax stated that they implemented a
new endpoint security tool to find
misconfigurations, evaluate possible
signs of compromise, and automatically
notify system administrators of identified
vulnerabilities
Changes
Source: https://www.warren.senate.gov/imo/media/doc/2018.09.06%20GAO%20Equifax%20report.pdf

11. THANK YOU!!!