Equifax Hack Blamed On Single Employee


We wrote about the Equifax Hack, Data Breach and Leak last month, which happened due to a flaw in Apache Struts that for some reason hadn’t been patched.

Equifax Hack Blamed On Single Employee


Now it seems the CEO Rick Smith is basically placing the blame on a single employee that failed to pass a message on to the right people, rather than taking responsibility for an organisational failure. It’s also interesting there was a scheduled security scan not long after the flaw was disclosed and it wasn’t detected.

Recently-and-forcibly-retired Equifax CEO Rick Smith has laid the blame for his credit-check biz’s IT security breach on a single member of the company’s security team.

In testimony on Tuesday before a US House subcommittee on consumer protection, Smith explained that Equifax has a protocol whereby news of important software patches is communicated to the appropriate people within a certain time. When details of security vulnerability CVE-2017-5638 landed in March 2017, bearing bad news about Apache Struts, that protocol broke down at Equifax due to human error, meaning no one was told to apply patches for the flaw. And, astonishingly, this is all one person’s fault rather than an obvious failure for the business as a whole, according to Smith.

“The human error was the individual who is responsible for communicating in the organisation to apply the patch, did not,” Smith told the subcommittee at around the 1:05:15 mark in the video below.

Congressman Greg Walden sought clarification of that statement, asking “Does that mean that that individual knew the software was there, and it needed to be patched, and did not communicate that to the team that does the patching? Is that the heart of the issue here?”

Smith’s reply was: “That is my understanding, sir.”


This Equifax hack was so avoidable, do they not use some kind of issue tracking or ticketing system, did someone not just need to create a Jira ticket and someone else checks that they created it, how can such a huge multi-million dollar corporation with such critical user data not have simple, industry standard check and balance procedures.

It’s sad, and it’s messed up and honestly, it’s also depressingly unsurprising.

Smith said the company had otherwise followed its protocol of distributing information on necessary patches and that in the case of CVE-2017-5638 its procedures were observed, except by the individual mentioned above.

The former CEO said the second cause of the attack was a failure of automated scanning conducted a week after the patch should have been applied. For as-yet-unknown reasons, scans did not detect the presence of un-patched Struts implementations.

Smith spent more than two-and-a-half hours testifying and, after apologising and taking responsibility for the hack, spent much of that time defending Equifax’s decision to withhold news of the hack for many days after discovering it. Smith repeatedly justified the delay on grounds of avoiding further attacks and ensuring consumer protection measures could be in place.

“It did not help that hurricane Irma took down two of our larger call centres in the early days after the breach,” he said.

Committee members were not kind to Smith, who did not flinch in the face of stern criticism of Equifax’s security practices and response.

I hope the committee comes down like a tonne of bricks on all of those negligently involved in this travesty that has affected the majority of American citizens.

I’m also curious to see if the details are exposed of why the subsequent scan did not detect the vulnerability that caused the Equifax hack.

The law is also pretty sad, under current law they are required to alert those whos accounts have been hacked..but there’s no penalty if they dont.

Source: The Register

Posted in: Hacking News


Latest Posts:


APT-Hunter - Threat Hunting Tool via Windows Event Log APT-Hunter – Threat Hunting Tool via Windows Event Log
APT-Hunter is a threat hunting tool for windows event logs made from the perspective of the purple team mindset to provide detection for APT movements hidden in the sea of windows event logs.
GitLab Watchman - Audit Gitlab For Sensitive Data & Credentials GitLab Watchman – Audit Gitlab For Sensitive Data & Credentials
GitLab Watchman is an app that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally, this includes code, commits, wikis etc
GKE Auditor - Detect Google Kubernetes Engine Misconfigurations GKE Auditor – Detect Google Kubernetes Engine Misconfigurations
GKE Auditor is a Java-based tool to detect Google Kubernetes Engine misconfigurations, it aims to help security & dev teams streamline the configuration process
zANTI - Android Wireless Hacking Tool Free Download zANTI – Android Wireless Hacking Tool Free Download
zANTI is an Android Wireless Hacking Tool that functions as a mobile penetration testing toolkit that lets you assess the risk level of a network using mobile.
HELK - Open Source Threat Hunting Platform HELK – Open Source Threat Hunting Platform
The Hunting ELK or simply the HELK is an Open-Source Threat Hunting Platform with advanced analytics capabilities such as SQL declarative language, graphing etc
trape - OSINT Analysis Tool For People Tracking Trape – OSINT Analysis Tool For People Tracking
Trape is an OSINT analysis tool, which allows people to track and execute intelligent social engineering attacks in real-time.


Comments are closed.