Equifax left a known software flaw unpatched — and exposed the data of 147 million people

Equifax is one of the three major US credit bureaus, holding the personal and financial data of hundreds of millions of people. In 2017 it disclosed one of the largest data breaches in history: attackers had exploited a known vulnerability in Apache Struts, a piece of web software, to access the personal data of about 147 million people — Social Security numbers, birth dates, addresses and, in some cases, driver's license numbers and credit card details.

The most damning detail was that the vulnerability was not unknown. A patch had been available months before the breach, but Equifax had failed to apply it across its systems. The attackers moved through the network undetected for weeks, and the company's failure to detect and contain the intrusion compounded the damage.

The fallout was severe. Equifax's chief executive, Richard Smith, resigned. The company agreed to a settlement of up to $700 million, including compensation to affected consumers and penalties, and it faced congressional hearings and lasting damage to its reputation. The breach became a landmark case in cybersecurity — a stark example of how a failure to apply a known, available patch can expose the most sensitive data of nearly half a country.