Equifax's breach went unseen for 76 days because a traffic-inspection certificate had expired.

Equifax is one of the three big US credit bureaus. In 2017, attackers stole personal data on at least 145.5 million people in the US. The US Government Accountability Office (GAO) later set out how.

In March 2017, the US Computer Emergency Readiness Team publicly flagged a flaw in Apache Struts, a widely used open-source framework for building web applications. It let attackers run commands on a server. Equifax circulated the notice to its system administrators, but the recipient list was out of date, so it never reached the people who should have patched the online dispute portal, where consumers upload documents to dispute their credit reports. A network scan a week later didn't detect the flaw there either.

Just 2 days after the alert, on 10 March, unknown individuals scanned Equifax, found the portal and confirmed they could run commands on it. From 13 May, in a separate incident, attackers got in again. From the portal they found a data store holding unencrypted usernames and passwords, and used them to reach 48 more databases beyond the portal's own 3, because the databases weren't segmented from each other. They ran about 9,000 queries and took data out in small pieces over normal encrypted web traffic.

Equifax had a device to inspect network traffic for exactly this kind of activity. But its digital certificate had expired about 10 months before the breach, so encrypted traffic passed through without being inspected. On 29 July 2017, a network administrator doing routine checks found the misconfiguration and replaced the certificate. With inspection back on, signs of an intrusion appeared. The attack had gone on for about 76 days.

Why it matters: Security fails quietly. An out-of-date mailing list left a server unpatched, and an expired certificate blinded the tool meant to catch the result. Know what you run and who owns it, segment your data, and alert on certificates long before they expire.