Equifax identified a weakness in an open-source software package called Apache Struts as the technological crack that allowed the breach
A backlit laptop computer keyboard, photo: Wikimedia
14 of September 2017 18:05:32
NEW YORK – Credit agency Equifax traced the theft of sensitive information about 143 million U.S. citizens to a software flaw that could have been fixed well before the burglary occurred, further undermining its credibility as the guardian of personal data that can easily be used for identity theft.Equifax identified a weakness in an open-source software package called Apache Struts as the technological crack that allowed hackers to heist Social Security numbers, birthdates, addresses and full legal names from a massive database maintained primarily for lenders. SECURITY FOR DUMMIESThe disclosure, made late Wednesday, cast the company's damaging security lapse in an even harsher light. The software problem was detected in March and a recommended software patch was released shortly afterward. Equifax said the database intrusion began in May and continued until July.Security experts said Equifax had more than enough opportunity to block intruders by sealing the security hole. "There is no excuse for not following basic cybersecurity hygiene," said Nate Fick, CEO of the security firm Endgame. "Some heads should definitely roll for this; it's only a question of how many."
Investors are clearly concerned about Equifax's fate. The company's stock has lost nearly a third of its value since it disclosed the breach. Three Equifax executives, including the company's chief financial officer, preserved a significant chunk of their wealth by selling stock worth a combined $1.8 million just after management learned of the breach, but well before the public was notified.Equifax said last week that the officials didn't know about the breach at the time of those sales. MORE INVESTIGATIONIn another sign of the storm swirling around Equifax, the Federal Trade Commission (FTC) took the unusual step of announcing it has opened a probe into the company's practices.The FTC is not the only Washington authority looking into the breach. The Consumer Financial Protection Bureau previously announced its own investigation, and the House Financial Services Committee plans to hold hearings on the breach in early October when Smith is scheduled to testify. Politicians from both major parties are calling for additional investigations by Congress or the Department of Justice, raising the possibility of criminal charges.A proposal to impose sweeping reforms on Equifax and its two main peers, TransUnion and Experian, also has been drawn up by Rep. Maxine Waters, a California Democrat.
We must get to the bottom of this, the murky bottom. Equifax must be held accountable and answer for its actions.— Chuck Schumer (@SenSchumer) 14 de septiembre de 2017
KEN SWEETMICHAEL LIEDTKE