Failure pattern · United States · 2017–2019
Equifax 2017: an unpatched flaw exposes 147 million people
Hackers exploited a known software vulnerability that Equifax hadn't patched for months, stealing sensitive data on about 147 million people. The response was slow and confused.
By Shivam Bhandari · Reviewed 31 October 2026 · How we write
by the numbers
- People affected
- about 147 million
- Months between patch release and breach
- about 2
- Settlement (2019)
- up to about $700 million
What happened
Equifax, one of the three big US credit bureaus, holds detailed financial data about most American adults. In March 2017 a fix was released for a flaw in Apache Struts, a widely used web framework. Equifax did not apply it to a key system.
Attackers got in from May to July 2017 and stole names, Social Security numbers, birth dates, and addresses of about 147 million people. Equifax announced the breach in September — weeks after discovering it — and its response website was confusing and initially seen as a phishing risk. Some executives had sold shares before disclosure; one was later convicted of insider trading.
The CEO retired, and in 2019 Equifax agreed to a settlement of up to about $700 million with US regulators and states.
Timeline
- 2017
Patch released (March); breach (May–July); disclosure (September); CEO retires.
- 2019
Regulatory settlement.
what went wrong
- Basic security hygiene (patching) failed.
- Slow disclosure damaged trust.
- Poorly designed customer response.
the lesson
Catastrophic failures often come from basic tasks left undone — and slow disclosure turns a breach into a trust crisis.
Apply it to your business
- 1Have a clear owner and deadline for security updates.
- 2Prepare a breach response plan in advance.
- 3Disclose quickly and help affected customers simply.
Laws at work in this story
Figures are rounded and drawn from public reports, company filings and widely cited coverage at the time. Check the company's latest filings before relying on any number.