ALT-44 · Analysis · 23 Oct 2026
Equifax: one missed patch, 147 million people
A web framework flaw patched in March 2017 was still open at Equifax in May. Attackers spent 76 days inside, unseen, partly because an expired certificate blinded a monitoring device.
- 7 Mar 2017Apache Struts fix for CVE-2017-5638 released.
- 13 May 2017Attackers gain access through the unpatched portal.
- 29 Jul 2017Equifax detects the activity after renewing the expired certificate.
- Jul 2019Settlement with the FTC, CFPB and states: at least $575 million, up to $700 million.
- People whose data was exposed
- ~147MFTC
- Undetected attacker activity
- 76 daysGAO-18-559
What failed
- The patch notice reached the team, but the vulnerable system was not identified and patched.
- A traffic-inspection device ran with a certificate that had expired months earlier.
- Databases were reachable from the portal, and credentials were found stored in plain text.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Patch management is an inventory problem first.
- Monitoring that silently stops working is worse than none, because it reassures.
- Segmentation decides whether one bug exposes one system or all of them.
What to do
- Keep an asset inventory that maps software components to the systems running them.
- Alert on certificate expiry for security tooling, not only for websites.
- Separate internet-facing applications from the databases behind them.
Sources
- GAO — Data protection: actions taken by Equifax and federal agencies (GAO-18-559)
- FTC — Equifax to pay $575 million as part of settlement with FTC, CFPB and states (Jul 2019)
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-44 — Equifax: one missed patch, 147 million people. 23 Oct 2026. altumptic.com/research/equifax-2017