SAN FRANCISCO — Hackers took advantage of an Equifax security vulnerability two months after an industry group discovered the coding flaw and shared a fix for it, raising questions about why Equifax didn't update its software successfully when the danger became known.
A week after revealing one of the largest breaches of consumers' private financial data in history — 143 million consumers and access to the credit card data of 209,000 — Equifax and the industry group that manages the open source software in which the hack occurred released more details about what happened and when.
"The Equifax data compromise was due to (Equifax's) failure to install the security updates provided in a timely manner," The Apache Foundation, which oversees the widely-used open source software, said in a statement Thursday.
Equifax told USA TODAY late Wednesday that the criminals who potentially gained access to the personal data of up to 143 million Americans had exploited a website application vulnerability known as Apache Struts CVE-2017-5638.
The vulnerability was patched on March 7, the same day it was announced, the The Apache Foundation said. Cybersecurity professionals who lend their free services to the project of open-source software — code that's shared by major corporations, and that's tested and modified by developers working at hundreds of firms — had shared their discovery with the industry group, making the risk and fix known to any company using the software. Modifications were made on March 10, according to the National Vulnerability Database.
But two months later, hackers took advantage of that breach: Equifax said that the unauthorized access began in mid-May.
Equifax did not respond to a question Wednesday about whether the patches were applied and if not, why not.
"We continue to work with law enforcement as part of our criminal investigation, and have shared indicators of compromise with law enforcement," it said.
It should have have acted faster to successfully deal with the problem, said other cybersecurity professionals.
"They should have patched it as soon as possible, not to exceed a week. A typical bank would have patched this critical vulnerability within a few days,” said Pravin Kothari, CEO of CipherCloud, a cloud security company.
Federal regulators are now investigating whether Equifax is at fault. The Federal Trade Commission and the Consumer Financial Protection Bureau have said they've opened probes into the hack.
Proof that Equifax failed to protect customers, particularly when it had the tools and information to do so, is likely to further damage Equifax's financial outlook. Shares fell 1% Thursday after news of the FTC probe and are down 33% since it revealed the link.
The initial report of the security vulnerability says that a company using the software needed only to upgrade to a more recent version of the Apache Struts program, a framework for web servers that help companies, including many Fortune 500 corporations, take in and serve up data.
Experts say the information potentially stolen by the hackers, including Social Security numbers, dates of birth and names, could put people at risk of identity theft for the rest of their lives.
Equifax CEO Richard F. Smith apologized Tuesday in a USA TODAY op-ed and said that the company initially "thought the intrusion was limited" after discovering it on July 29.
Equifax has indicated that it had not yet had determined the full impact of the breach.
The company offered consumers free credit monitoring and identity theft insurance.
"We are devoting extraordinary resources to make sure this kind of incident doesn’t happen again," Smith said. "We will make changes and continue to strengthen our defenses against cyber crimes."
The researchers who found the vulnerability identified Wednesday by Equifax as the cause of the breach had prepared two plugins that could be used as a drop-in solution, which they posted online.
To be sure, the process of patching the flaw isn’t as simple as just downloading a new version of Java. It requires searching the company’s entire portfolio of applications to look for known and newly-reported vulnerabilities, then updating to the latest version of those applications. It is then often necessary to rewrite the applications so they match the other software the company is using. Then everything must be retested and redeployed.
To some in the industry, it’s not that Equifax had bad security practices, but that such poor security hygiene is all too common.
"A majority of large companies have similar challenges, problems and weakness in their cybersecurity. Most companies still fail to maintain a proper application inventory and thus keep critical vulnerabilities unpatched for months," said Ilia Kolochenko, CEO of High-Tech Bridge, a Swiss web security company.
Patching can take time, even for large corporations with dedicated security staff, which Equifax presumably had, noted Jeff Williams, co-founder of Contrast Security. Williams identified a different Struts vulnerability earlier this year.
Still, not doing so is “absolutely unreasonable,” he said.