Equifax's breach went unseen for 76 days because a traffic-inspection certificate had expired

transcript

Personal data on at least 145 point 5 million people. Stolen. And for 76 days, nobody at Equifax saw it happening.

March 2017. A flaw in Apache Struts goes public. Attackers can run commands. Two days later, someone scans Equifax. They find a server that's still open. 13 May. Attackers get in and start taking data. It's spotted on 29 July.

Equifax did send the patch alert around. To an out-of-date list. So the dispute portal's owners never got it. It stayed unpatched. Inside, attackers found usernames and passwords. Unencrypted. Nothing separated the databases. They reached 48 more. Then they took the data out in small pieces. Encrypted, like normal traffic.

But here's the catch. Equifax had a device to inspect that traffic. Built to catch exactly this.

Its job: look inside encrypted traffic. Its certificate had expired. About 10 months before the breach. So encrypted traffic just walked past it. Uninspected.

29 July. An admin doing routine checks replaces the certificate. Inspection restarts. The intrusion shows up. About 9 thousand queries. Over 76 days.

An old mailing list. An expired certificate. Neither made a sound. Know who owns every server. Alert on certificates long before they expire.

Full story in the article.