INCIDENT REPORT · CP-2017-003

Equifax data breach

L3 · ELEVATEDCONFIRMED

Credit bureau Equifax disclosed on 7 September 2017 that attackers had stolen consumers' personal data. They had access from mid-May to late July 2017 through an unpatched web application flaw.

Incident ID: CP-2017-003
Disclosure date: 07 SEP 2017
Detection date: 29 JUL 2017
Affected countries: United States
Plotted location: Atlanta, United States (Affected organization headquarters)
Threat classification: Level 3 — ELEVATED
Classification rationale: One of the largest consumer data breaches in history, but no operational disruption to essential services.
Attack type: Data Breach
Nature: Malicious activity
Attack vector: Exploitation of an unpatched Apache Struts vulnerability (CVE-2017-5638) in Equifax's online dispute portal
Sectors: Finance
Critical infrastructure: No
Organizations affected: Equifax
Operational consequences: Equifax initially reported 143 million affected consumers, later raised to about 148 million. Exposed data included names, Social Security numbers, birth dates, addresses and some driver's license numbers.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by the US Department of Justice (February 2020 indictment) to four members of China's People's Liberation Army 54th Research Institute

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Equifax data breach

L3 · ELEVATEDCONFIRMED

Credit bureau Equifax disclosed on 7 September 2017 that attackers had stolen consumers' personal data. They had access from mid-May to late July 2017 through an unpatched web application flaw.

Incident ID

CP-2017-003

Disclosure date

07 SEP 2017

Detection date

29 JUL 2017

Affected countries

United States

Plotted location

Atlanta, United States (Affected organization headquarters)

Threat classification

Level 3 — ELEVATED

Classification rationale

One of the largest consumer data breaches in history, but no operational disruption to essential services.

Attack type

Data Breach

Nature

Malicious activity

Attack vector

Exploitation of an unpatched Apache Struts vulnerability (CVE-2017-5638) in Equifax's online dispute portal

Sectors

Finance

Critical infrastructure

Organizations affected

Equifax

Operational consequences

Equifax initially reported 143 million affected consumers, later raised to about 148 million. Exposed data included names, Social Security numbers, birth dates, addresses and some driver's license numbers.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by the US Department of Justice (February 2020 indictment) to four members of China's People's Liberation Army 54th Research Institute