sb-eu logo
Story image

2017 Equifax breach: Impact and lessons learned

02 Oct 2017

By Rick Holland, VP Strategy at Digital Shadows

Equifax experienced a data breach that occurred in mid-May 2017, was first discovered on 29 July 2017, and was publicly disclosed by the company on 07 September 2017.

The breach affected 143 million individuals in the United States, Canada and the United Kingdom. Immediately after the disclosure Equifax faced widespread criticism from the media, researchers and customers. There have also been allegations of insider trading and legal implications.

In our paper Equifax Breach: Lessons Learned for Your Organisations, we outline how the events surrounding the breach demonstrate several important learning points organisations can use to inform their own security posture.

The largest immediate impact to Equifax was loss of investor confidence; the share price dropped 34 percent within eight days after the breach disclosure. The company also risks revenue loss resulting from reduced business, especially considering customers’ loss of confidence in the company to secure data. As with all data breaches, Equifax will also incur financial losses through its responsive investigations and, likely, costs resulting from lawsuits.

Swift public criticism followed around Equifax’s security posture, its handling of the breach and the exposure of the sensitive customer data. Some employees have been accused of insider trading, and others have reportedly left their positions, such as the chief security officer and chief information officer. Reputational damage may have a mid- to long-term effect on the company’s revenue generation and a prolonged impact on its finances.

The key lessons organisations can learn from this event are:

Maintain an external view of your digital footprint to be aware of what an attacker can access, what is vulnerable to attack and what methods attackers are using against your sector.

Establish and maintain a threat intelligence program, and act on the intelligence; Digital Shadows provided clients with multiple alerts about exploitation of the vulnerability that affected Equifax, prior to the intrusion.

Implement and follow general cyber-security good practice measures, such as defence-in-depth and including vulnerability management. Plan as if an attacker will compromise your network and ensure your sensitive information will be protected.

Assume a breach will occur and plan for this outcome. Ensure people, processes and strategy are in place in advance of it.

Control knowledge of a breach to trusted individuals and prepare for announcements by analysing the possible consequences of decisions.

Communicate clearly when a breach happens, stating the knowns and unknowns publicly. Speculation from media and researchers can damage reputation.

Look for your compromised data online, to try to discern the attacker’s motive. Understanding whether the motive was financial gain may help mitigate against prolonged malicious activity.

Story image
Three-in-one cloud security can ease business through difficult times
By leveraging a comprehensive security platform, organisations can block threats and prevent leakage for all interaction between endpoints, devices and apps, writes Bitglass product marketing manager Juan Lugo. More
Story image
Why greater network visibility is needed to reduce the threat posed by IoT in the enterprise
At home and abroad, organisations have joined the rush to embrace Internet of Things (IoT) technology, but a new survey shows they’re only just beginning to wake up to the enormous risk those devices pose, writes ExtraHop A/NZ Regional Sales Manager Glen Maloney.More
Story image
Video: 10 Minute IT Jams – Who is Claroty?
Its focus is on simplifying OT availability, reliability, and safety for a more secure working environment – without requiring downtime or dedicated teams.More
Story image
Interview: ThreatQuotient champions threat intelligence through virtual 'situation rooms'
To understand what it involves and some of the collaboration challenges that come with distributing threat intelligence amongst specialised security teams, we spoke to ThreatQuotient APJC regional director Anthony Stitt.More
Story image
42% more plaintext HTTP servers than HTTPS counterparts - report
Rapid7 has released a report detailing the changing internet risk landscapes of 2020, and other issues facing cybersecurity teams.More
Story image
Internet outages drastically increased during COVID-19 lockdowns, report finds
Global internet disruptions increased 63% in March, with internet service providers hit the hardest. This is according to the 2020 Internet Performance Report from ThousandEyes, the internet and cloud intelligence company.More