The Equifax Breach — After the Theft of Data No One Chose to Hand Over

A Company Holding Information You Never Gave It

On September 7, 2017, Equifax, a credit reporting agency headquartered in Atlanta, Georgia, announced a cybersecurity incident potentially affecting roughly 143 million U.S. consumers (Equifax announcement). Credit reporting agencies collect information about consumers to create credit scores and detailed reports, selling those reports to third parties. Consumers never gave these companies their information voluntarily, and they cannot opt out of collection (House Oversight Majority Staff Report). The three largest credit reporting agencies in the United States are Equifax, Experian, and TransUnion (GAO Report).

Credit reports contain names, dates of birth, Social Security numbers, phone numbers, and current and past addresses. These reports determine whether someone can rent a home, buy a car, or get a mortgage (Senate Permanent Subcommittee on Investigations Report). Information like this, by itself or combined with other information, is personal data that can identify a specific person ("Personal Data and Anonymization — Erase the Name, and the Person Remains"). A Social Security number is a unique number assigned by the U.S. government to citizens and certain residents, used to identify individuals in taxes and credit transactions. The House report noted that as a result of this breach, "nearly half of the nation's Social Security numbers are no longer secret" (House Oversight Majority Staff Report).

The compromised system was Equifax's "online dispute portal." This is a web service where consumers can upload documents to request corrections if their credit reports contain errors (GAO Report). According to the House report, this portal was a custom system built in the 1970s and was running in an aging environment (House Oversight Majority Staff Report).

This incident was recorded separately in several official documents. A report by the House Committee on Oversight and Government Reform (December 2018) states on its cover that it was written by majority staff (the majority party at the time was the Republican Party). The Government Accountability Office (GAO), an audit agency under Congress, issued a report in August 2018 noting that its description of the incident's timeline and causes was largely based on accounts from Equifax personnel, and it stated itself that it did not independently verify Equifax's security controls (GAO Report). The Senate Permanent Subcommittee on Investigations also issued a staff report (March 2019). These are joined by the U.S. Federal Trade Commission's (FTC) 2019 settlement announcement, two announcements made by Equifax itself in September 2017, and the U.S. Department of Justice's 2020 indictment announcement. This article follows this event that occurred in the United States using these American documents, identifying in parentheses for each sentence which document it comes from.

This article lingers longer on what happened after the breach than on the breach itself. What did the breached people do? Did impersonation using the stolen information increase? Were the notification laws effective? What price did the company pay? There is research addressing these questions.

The Patch Released on March 7

On March 7, 2017, a severe vulnerability (CVE-2017-5638) in Apache Struts, a software component used to build web services, was publicly disclosed along with a fixed version (House Oversight Majority Staff Report). A vulnerability is a weak spot in a system that attackers can dig into to cause unintended actions, and a patch is a revised version that fixes such a vulnerability and is released anew ("Security — Unseen by Others, Unchanged in Secret, Open When Needed"). The U.S. National Institute of Standards and Technology (NIST) gave this vulnerability a 10, the highest possible severity score. The Senate subcommittee concluded that the tools needed to exploit this vulnerability were publicly available and easy to use, meaning that even someone without advanced hacker skills could use them with basic computer knowledge (Senate Permanent Subcommittee on Investigations Report). Why patches for vulnerabilities inside components spread slowly is covered in "The Log4j Vulnerability — Who Finds the Part Buried in the Wall?".

The next day, US-CERT under the U.S. Department of Homeland Security warned Equifax about this vulnerability. On March 9, Equifax's threat and vulnerability management team emailed over 400 people instructing anyone using Apache Struts in their systems to patch it within 48 hours (House Oversight Majority Staff Report). On March 14, they added a new rule to their intrusion prevention equipment to block attempts targeting this vulnerability, and according to the Senate subcommittee, Equifax believed this allowed them to detect and block attack attempts (Senate Permanent Subcommittee on Investigations Report). On March 15, the security team ran a scan to find vulnerable systems, but did not find the vulnerability in systems exposed to the outside (House Oversight Majority Staff Report).

Events on March 10 are recorded differently across documents. Citing a briefing by security firm Mandiant, the House report notes that the first traces of attackers exploiting this vulnerability appeared on a server connected to the Equifax network on this day (House Oversight Majority Staff Report). The Government Accountability Office report relays Equifax's explanation, describing it as an event where unidentified parties scanned the system, found a portal server, and checked whether access was possible. Their explanation is that no data was taken at this time, and that the intrusion that began in May was a separate incident (GAO Report). The same day is read by one document as the first trace of an attack and by another as preliminary reconnaissance with no data exfiltrated.

The patch came out in March and the company even issued an instruction to apply it within 48 hours, but it failed to find the vulnerable system.

76 Days, and the Monitoring Equipment That Was Turned Off

According to the House report, attackers entered the portal through this vulnerability on May 13, 2017, and the attack continued for 76 days (House Oversight Majority Report). The Government Accountability Office report also noted approximately 76 days until it was discovered (U.S. Government Accountability Office Report). The Senate subcommittee recorded the period the attackers were able to move around undetected as 78 days (Senate Permanent Subcommittee on Investigations Report). Neither document explains why 76 days and 78 days differ by two days.

The attackers did not stop at the three databases attached to the portal. Using unencrypted IDs and passwords found elsewhere, they expanded their access to 48 databases unrelated to the portal and ran about 9,000 queries (U.S. Government Accountability Office Report). Encryption is the act of scrambling information so that only someone with the key can turn it back into its original content ("Encryption — The Content Is Locked, but the Record of Comings and Goings Remains"). According to the House report, out of those 9,000 queries, unencrypted personal information was found 265 times, and the attackers moved that data out of Equifax, but Equifax did not know this (House Oversight Majority Report).

The reason the House report gives for not seeing the data leaving is the monitoring equipment. The equipment watching the portal's network traffic was not working because a security certificate had expired (House Oversight Majority Report). A certificate is a document where a third party signs that this public key belongs to this person ("Keys and Locks — Why a Public Key Is Safe to Publish"). An internal record from January 2017 cited by the House report already stated, "Without a certificate, our eyes to see web attacks are limited" (House Oversight Majority Report).

How long that equipment had been turned off was recorded differently by the three documents. The House report stated that it did not work for 19 months until the breach was noticed (House Oversight Majority Report). The Government Accountability Office report stated that the certificate expired about 10 months before the intrusion (U.S. Government Accountability Office Report). The Senate subcommittee recorded that the certificate expired in November 2016 and was not renewed for eight months (Senate Permanent Subcommittee on Investigations Report). Following the House report, the expiration was around early 2016, and following the other two documents, it was the mid-to-late part of 2016, and the three documents alone cannot determine which side is correct. However, all three time points precede May 13, 2017, when the intrusion began. Regardless of which document is followed, at the time the intrusion began, that equipment's certificate had already expired.

On the night of July 29, Equifax renewed the expired certificate, and immediately suspicious traffic was visible. The House report recorded the origin as an IP address in China (House Oversight Majority Report). According to the Senate subcommittee, the renewal on the night of this day was an IT administrative task unrelated to this vulnerability, changing dozens of expired certificates all at once (Senate Permanent Subcommittee on Investigations Report). The action that exposed the intrusion was not an action intended to find the intrusion. According to Equifax's explanation, the security team saw suspicious traffic on July 29, and took the portal down on July 30 after seeing additional activity (Equifax Announcement). According to the House report, the attack ended with the taking down of the portal (House Oversight Majority Report). The vulnerability patch was actually applied the following week on August 2, almost five months after the vulnerability was disclosed (Senate Permanent Subcommittee on Investigations Report).

While the intrusion continued, the monitoring equipment was turned off, and what exposed the intrusion was a certificate changed for another matter.

The Announcement Six Weeks Later and the Changed Numbers

On July 31, the Chief Information Officer (CIO) reported the incident to Chief Executive Officer (CEO) Richard Smith, and on August 2, Equifax hired the security firm Mandiant to conduct a forensic investigation tracking the traces of the intrusion and contacted the Federal Bureau of Investigation (FBI) (House Oversight Majority Report). On September 4, Equifax and Mandiant finalized a list of 143 million victims (House Oversight Majority Report).

Public disclosure of an incident is the act of revealing to the world that an intrusion or a leak has occurred. Equifax's disclosure of the incident was on September 7. Unauthorized access had occurred from mid-May through July, and Equifax's explanation that day was that no evidence of unauthorized activity was found in the core credit database (Equifax Official Announcement). The Senate Subcommittee criticized that this announcement came 6 weeks after knowing about the incident and nearly 4 months after the hackers got in. An explanation from Equifax officials, recounted in the same report, was that they decided to make the announcement only after confirming every single person who suffered damage (Senate Permanent Subcommittee on Investigations Report).

The number of victims changed after that as well. On October 2, Equifax corrected 143 million to 145.5 million by rectifying its mistaken judgment that a single query by the attacker had not taken data. On March 1, 2018, it further identified about 2.4 million people whose names and driver's license information were partly stolen, and how many of them overlapped with the already counted 145.5 million was not determined even by August 2018 (GAO Report). The House report noted a total of 148 million by adding the 2.4 million, which is nearly half of the U.S. population and 56% of adults (House Oversight Majority Report). From the standard of the GAO report, this 148 million is a sum whose overlap has not been verified.

The FTC's announcement listed the figures by item. Names and dates of birth were for at least 147 million, Social Security numbers for 145.5 million, and payment card numbers and expiration dates for 209,000 (FTC Settlement Announcement). Victims outside the U.S. also numbered close to 1 million, and because many records were incomplete, not every victim had every item stolen (GAO Report).

The number of victims has never been fixed to a single figure, and ranges between 143 million and 148 million across the incident investigation documents.

The Causes That Split Over the Same Email

On October 3, 2017, former CEO Smith told Congress that human error and the failure to communicate that a patch was needed were the root causes of the breach. On October 2, Equifax fired a senior executive in charge of the portal for 「failing to forward」 the Apache Struts alert email (House Oversight Majority Staff Report). The House report noted that the executive had never been instructed to forward the email, and that the firing came the day before the former CEO's congressional testimony, writing that 「this PR-driven action seems unjustifiable in light of all the facts」 (House Oversight Majority Staff Report).

Documents attributed different weights to the reasons why the email did not reach its destination. Equifax's own analysis, relayed by the Government Accountability Office, noted that the recipient list for the alert email was outdated and therefore failed to reach the people responsible for installing the patch (GAO Report). According to the Senate subcommittee, a portal developer who knew Equifax used Apache Struts was not on the list of 400, and the manager on the list who received the email did not forward it to the developer or their team. Moreover, at Equifax, developers had to individually subscribe to security notifications sent by software vendors (Permanent Subcommittee on Investigations Report). The Senate subcommittee's description includes both the person who failed to forward the notification and the structure that left alerts to individual subscriptions. The FTC claimed in its complaint that although the security team instructed a patch within 48 hours, it never verified whether it was actually carried out (FTC Settlement Announcement).

The center of gravity of the causes also varies by document. Equifax's own analysis cited four prongs: identification, detection, segregation, and data management. Databases lacked partitions so intruders could move on to other databases, and query limits were absent, allowing about 9,000 queries to be run—far more than normal operations. The GAO noted that it did not independently verify this analysis (GAO Report).

The House report placed the management structure as the cause. It stated that lines of responsibility and authority in the IT management structure were unclear, creating a gap between policymakers and executors, and that aggressive acquisition-driven growth and data accumulation produced a complex, aging IT environment (House Oversight Majority Staff Report). In July 2017, the company lacked an up-to-date inventory listing every IT asset and the software running on them, and the executive in charge of the portal testified that he did not even know Apache Struts was running in that environment until the incident was made public. There was also no certificate management procedure, leaving at least 324 security certificates expired, 79 of which belonged to equipment monitoring core business areas (House Oversight Majority Staff Report). Speaking of a 「culture of cybersecurity complacency,」 the House report wrote that the failure to patch a known, severe vulnerability left the system exposed for 145 days—from the March 8 alert to the July 30 portal shutdown—and concluded that the breach was 「entirely preventable」 (House Oversight Majority Staff Report).

The Senate subcommittee looked at older neglect. A 2015 internal patch audit had found over 8,500 vulnerabilities that remained unpatched past their deadlines, pointing out an 「honor system」 that did not verify whether patches were actually installed and a lack of an IT asset inventory, but no further audits were conducted after that (Permanent Subcommittee on Investigations Report). The CIO at the time called patching a 「six-levels-down sub-responsibility.」 Competitors TransUnion and Experian, which received the same alerts, possessed accurate, up-to-date IT asset inventories, found the vulnerable spots, and patched them; within the scope seen by the Senate subcommittee, there were no signs of attacks by hackers targeting this vulnerability. The Senate subcommittee used the expression that the damage caused by the hackers 「could have been mitigated」 (Permanent Subcommittee on Investigations Report).

Different voices emerged from within Equifax. Most current and former security and IT employees interviewed by the Senate subcommittee believed the security team's response was appropriate, and the CIO at the time felt there was nothing Equifax could have done differently (Permanent Subcommittee on Investigations Report). The FTC Chair stated that Equifax failed to take 「basic steps that could have prevented the breach」 (FTC Settlement Announcement).

The strength of the answers to whether it 「could have been prevented」 varies across documents, ranging from the House report's 「entirely preventable」 to the FTC's 「could have prevented,」 the Senate subcommittee's 「could have mitigated,」 and the view of many Equifax employees that 「the response was appropriate.」 The two congressional reports established management structure and long-standing neglect as the causes, placing the failure to forward the email as one scene within that structure.

People Who Heard the News of the Leak

Let us follow one American who tried to check whether their information had been stolen after listening to the announcement on September 7, 2017. The dedicated website and call center opened by Equifax crashed immediately, and consumers could not find out whether they were affected in time (House Committee on Oversight and Government Reform Majority Staff Report). That site, set up at a separate address, looked suspicious, and Equifax's official Twitter account led people to a phishing site for nearly two weeks after an employee mistakenly reversed the word order in the address (House Committee on Oversight and Government Reform Majority Staff Report). Phishing is a trick that uses messages disguised as coming from a trustworthy source to extract information like passwords or to make people open harmful links and files ("Phishing and Social Engineering — Ringing the Doorbell Instead of Breaking the Lock"). US-CERT warned consumers about phishing scams taking advantage of this leak (House Committee on Oversight and Government Reform Majority Staff Report).

Equifax offered free credit monitoring and identity theft insurance to all U.S. consumers for one year (Equifax company announcement). Identity theft is when someone who gets hold of another person's personal information pretends to be that person, using existing cards or accounts, opening new accounts, or obtaining government benefits or medical care in that name. Credit monitoring is a service that alerts you if changes occur in your credit record, such as new accounts or inquiries.

Another path was a credit freeze. A credit freeze is keeping places that want to lend new money from looking at your credit report. At the time, freeze regulations differed by state, and each credit bureau usually charged $5 to $10. Freezing became free by federal law starting on September 21, 2018 (Government Accountability Office Report). Freeze requests flooded in, causing technical problems, and Equifax decided not to charge freeze and unfreeze fees until November 21, 2017 (Equifax company announcement). To do everything this single person could do, they had to first check for damage between the crashed site and fake sites and request a freeze from each credit bureau separately.

Right after the announcement, the ones who went ahead with freezes more often were people who had experienced harm. People who had previously experienced identity theft or another leak were more likely to freeze their credit reports and close credit card accounts right after the Equifax announcement than those without such experience, and those who experienced identity theft did so even more than those who only experienced a leak (DOI: 10.21799/frbp.wp.2022.36, Federal Reserve Bank of Philadelphia Working Paper). In polling data from North Carolina, how much people used computers did not predict whether they would take self-protection steps after the Equifax leak, while negative emotions about identity theft drove people to take action (DOI: 10.1080/15564886.2021.1876801). In a preliminary study interviewing four consumers right after the announcement, participants named identity theft as the biggest risk and felt unable to control their own information collected by credit bureaus, yet they did not take enough protective steps to counter that risk (DOI: 10.1145/3170427.3188510).

In a study looking at a different year and a different leak, what moved people was clear proof that they had been hacked. Among consumers directly harmed in the 2012 South Carolina Department of Revenue leak, a noticeably large proportion signed up for fraud prevention services right away, while the response from consumers who only encountered the news without direct harm was negligibly small. The authors concluded that in this case consumers reacted mainly to clear evidence of their own exposure (DOI: 10.21799/frbp.wp.2015.42, Federal Reserve Bank of Philadelphia Working Paper). In an online survey and follow-up covering multiple leaks, participants were unaware of 74% of the leaks that applied to them. Some people said they would take action, but most believed the leak would not affect them, and the gap between intending to act and actual behavior was wide. Apathy, costs incurred, forgetting, and resignation were the reasons. The authors concluded that the leaking institution should bear the responsibility of notifying victims more actively and protecting them (DOI: 10.1145/3589958).

Notifications sent by companies were also not written to help action. A data breach notification is when a company whose personal information leaked informs the owners of that information of that fact. While a public accident disclosure is an announcement toward the world, a data breach notification is a notice toward each individual victim. 161 breach notification letters sent to consumers by various companies were long and demanded high reading ability, and many companies played down or blurred the likelihood that the recipient was affected and its risks. Actionable steps were buried inside long paragraphs, and guidance on what was urgent and what was effective was rarely provided. The authors recommended ways to design notices so they are easier to understand (DOI: 10.1145/3290605.3300424).

There may be reasons for not acting as well. A doctoral dissertation dealing with consumer behavior after a leak noted that while inaction is sometimes a mistaken judgment, it can also stem from rational cost-benefit calculation or resignation in the face of real-world constraints (DOI: 10.7302/6914, Doctoral Dissertation).

In the research following Equifax, what moved people was the harm they had experienced and their emotions, and in other leaks, it was clear proof that they had been hacked. Checking for damage and placing a freeze were left up to the victims.

Does Stolen Information Lead to Identity Theft?

The three branches of identity theft—unauthorized use of existing accounts, opening new accounts, and other forms of theft such as government benefits or medical care—were all associated with having experienced a data leak from a government or corporation, while everyday habits like changing online passwords and shredding documents were associated with protection. This is data from the U.S. National Crime Victimization Survey in 2012 and 2014, predating Equifax (DOI: 10.1016/j.pmedr.2020.101058). Because it is an association, this study did not determine the exact share of how much leaks cause theft.

The damage did not stop at money. In studies using the same national survey independently of this incident, people who experienced identity theft suffered emotional symptoms like depression and physical symptoms of worsening health, in addition to losing money and time (DOI: 10.1080/15564886.2016.1177766). There was also an association where the longer the resolution took, the greater the distress across all outcomes, and the authors concluded that the non-monetary consequences of identity theft are a fundamentally different phenomenon from financial loss (DOI: 10.1177/00938548231223166).

Accounting for a delay of 1 to 2 months until damage is discovered, the number of identity theft cases increased in a statistically significant way after major leaks (DOI: 10.48550/arxiv.2603.21270, 2026 preprint). This study is a model looking at multiple major leaks combined, and did not count whether individual Equifax victims suffered theft.

Data leaks and identity theft appear together and the damage goes beyond money, but whether this leaked data was actually used for identity theft was not covered by the incident documents examined in this article.

Did Laws Requiring Notification Reduce Identity Theft?

The United States has no comprehensive federal breach notification law, and all 50 states have their own notification laws. Because deadlines (such as "without unreasonable delay" or within 45 days of discovery) and definitions of personal information vary by state, the same leaked information might mean consumers in one state must be notified while consumers in another state do not need to be (House Oversight Committee Majority Report). The Government Accountability Office noted that the purpose of notification is to give victims the opportunity to take action for themselves against misuse such as identity theft (U.S. Government Accountability Office Report). The Senate Subcommittee cited examples such as the large retail chain Target taking 7 days, and Yahoo! disclosing breaches from 2013 and 2014 only in 2016 and 2017, calling this a "patchwork of uncertainty," and recommended that Congress create a law requiring notification to consumers, law enforcement, and regulators without unreasonable delay (Senate Permanent Subcommittee on Investigations Report).

Taking advantage of the fact that states enacted laws in different years, researchers compared the periods before and after the laws were created. Using FTC data from 2002 to 2009, introducing notification laws reduced identity theft resulting from breaches by an average of 6.1% (DOI: 10.1002/pam.20567). Looking at data from 2005 to 2017 with a Bayesian model, state size was what drove the correlation between breaches and identity theft, while the notification laws still slightly reduced the rate of identity theft (DOI: 10.5325/jinfopoli.10.1.0045). An academic conference abstract examining all 50 states and Washington, D.C. from 2003 to 2018 found no significant changes in the annual number and scale of breaches after the laws were created, and no significant changes in the long-term rates of identity theft and fraud. The authors surmised that differing notification criteria across states and other factors were the reasons (DOI: 10.5465/ambpp.2022.11493abstract, academic conference abstract). There is an estimate that after the state of California set notification criteria in 2016, medical identity theft reports decreased by 3.5 cases per 100,000 residents (DOI: 10.1111/jels.12331).

The four studies measured different things. They measured identity theft resulting from breaches, the rate of identity theft, the number of breaches and long-term identity theft rates, and medical identity theft reports.

The answers from research on whether notification laws reduced identity theft are split between "slightly reduced" and "no significant change," and neither side measured Equifax victims.

The Price Paid by the Company

In the first week of disclosure, Equifax's share price fell 35%, wiping out 6 billion dollars in market capitalization. This figure is cited by a House report quoting news coverage (House Oversight Committee Majority Staff Report).

In the breaches of other companies, stock price reactions have generally been found to be small. Looking at U.S. breach announcements from 2008 to 2018, companies were more likely to announce breaches on days expected to be news-crowded, and this timing selection was more common for severe breaches and those with internal causes. The more crowded the news day of the announcement, the smaller the drop in market capitalization. The authors concluded that this timing selection may explain the mixed results of previous studies (DOI: 10.1287/mnsc.2021.4264).

In a survey experiment simulating an online shopping company's breach, a price came with delaying notification as well. Trust dropped more significantly for a company that notified two months later compared to one that notified immediately upon discovery. While providing identity theft protection and credit monitoring restored trust, the late-notifying company still had lower trust even after the recovery (DOI: 10.1108/intr-12-2021-0939). In federal court breach lawsuits against other companies from 2000 to 2010, preceding Equifax, the odds of a company being sued were 3.5 times greater when victims suffered financial loss, and 6 times lower when the company provided free credit monitoring (DOI: 10.1111/jels.12035).

On July 22, 2019, Equifax reached a settlement with the FTC, the Consumer Financial Protection Bureau (CFPB), and 48 states plus Washington, D.C., and Puerto Rico, agreeing to pay at least 575 million dollars and up to 700 million dollars. It pays 300 million dollars into a fund to provide credit monitoring to affected consumers, 175 million dollars to these states and territories, and a 100 million dollar civil penalty to the CFPB (FTC Settlement Announcement). Starting January 2020 for seven years, it must provide all U.S. consumers with six additional free credit reports every year and undergo third-party assessments of its information security program every two years (FTC Settlement Announcement). The settlement is fact, but the unlawful conduct underlying it is the allegation in the FTC's complaint. The FTC files a complaint when it has "reason to believe" a law has been violated (FTC Settlement Announcement).

The price paid by victims must be estimated separately. Combining the loss per victim (including lost time and medical costs from distress) with the increase in identity theft following breaches, the earlier preprint modeled the social cost of the Equifax breach, estimating a lower bound of 263.8 million dollars and an upper bound of 1.72 billion dollars. The lower bound falls within the upper limit of the 700 million dollar settlement, while the upper bound is more than twice the settlement amount. In the 2009 Heartland and 2013 Target breaches, the lower bound alone was 5 and 18 times the settlement amounts, respectively. The authors reported that the social cost per victim has decreased significantly since 2016, and interpreted the narrowing gap between institutional liability and social cost as evidence of "market saturation," where an abundance of breached records reduces the harm of any single record (DOI: 10.48550/arxiv.2603.21270, preprint).

The price paid by Equifax is revealed in its stock price and settlement amount, but for the price paid by Equifax victims, model estimation from a single preprint is all there is among the studies examined in this article.

What We Still Do Not Know

In February 2020, the U.S. Department of Justice announced that a federal grand jury in Atlanta had indicted four members of the Chinese People's Liberation Army's 54th Research Institute on charges including computer fraud, economic espionage, and wire fraud conspiracy. According to the indictment, they were charged with stealing the personal information of roughly 145 million Americans and trade secrets consisting of Equifax's data organization and database design. The press release noted of its own accord that "the charges in an indictment are allegations, and the defendant is presumed innocent unless and until proven guilty beyond a reasonable doubt in a court of law" (미 법무부 기소 발표). A 2018 House report listed the origins of the suspicious communications only as a Chinese IP address and the address of a German internet company rented by a Chinese firm, and did not conclude who the attacker was (하원 감독위 다수당 보고서). What the documents stated about the attacker stops at the indictment stage—that is, the level of allegations.

Whether the stolen information was actually sold afterward or used for anyone's identity theft was not covered by the incident documents examined in this article. That the documents did not cover it does not mean it was not used, nor does it mean it was.

There are gaps in the records themselves. Because Equifax did not preserve internal messenger chats (the legal preservation order was on August 22, and actual preservation began on September 15), a Senate subcommittee noted that it did not have a complete record and could not fully understand the breach (상원 상설조사소위 보고서). The Government Accountability Office did not independently evaluate the corrective measures reported by Equifax (미 회계감사원 보고서). The periods when monitoring equipment was turned off—76 days and 78 days—and the 2.4 million overlapping individuals were also not resolved within these documents.

At the time of the 2018 House report, how helpful credit monitoring is remained open. The opinions heard by the House committee were split on both the value of credit monitoring and the length of time protection should be provided, and the House report recommended that the Government Accountability Office review the effectiveness and necessary duration of identity monitoring and protection services (하원 감독위 다수당 보고서).

Whose Job Was It After the Breach?

The attack targeting Equifax ended when the portal was taken down on July 30, 2017, but for most victims, this matter began with the announcement on September 7. Victims learned the facts through an announcement by a company they had never entrusted with their information, and to take action themselves, they had to check whether they were affected on a paralyzed site and place freezes with each credit bureau separately. The company offered one year of free credit monitoring and waived freeze fees, and through a settlement, it took on the obligations of a consumer fund, free credit reports, and regular security assessments. In research, people often said they would do things and then did not, and among those who took action, there were more people who had experienced harm and those who had received clear evidence that they had been breached. Studies are divided on whether laws requiring notification reduced identity theft.

At Equifax, the intrusion ended inside the company's system, but the task of checking for damage and placing freezes was left to each and every victim who had never entrusted their information.

How information like names and dates of birth points to an individual continues in "Personal Data and Anonymization — Erase the Name, and the Person Remains"; how fake sites riding on the news of a leak trick people continues in "Phishing and Social Engineering — Ringing the Doorbell Instead of Breaking the Lock"; and why vulnerabilities inside parts linger long after a patched version comes out continues in "The Log4j Vulnerability — Who Finds the Part Buried in the Wall?".

Incident Materials

• "The Equifax Data Breach" (2018-12) — https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf — House Committee on Oversight and Government Reform majority staff report. Timeline, causes (management structure, patches, certificates, aging IT), post-disclosure response, 7 recommendations.
• "Data Protection: Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach" (GAO-18-559, 2018-08) — https://www.gao.gov/assets/gao-18-559.pdf — U.S. Government Accountability Office performance audit. Timeline and causes mostly mirror Equifax explanations without independent verification. Revisions to the scope of damage, federal agency response.
• "How Equifax Neglected Cybersecurity and Suffered a Devastating Data Breach" (2019-03) — https://www.hsgac.senate.gov/wp-content/uploads/imo/media/doc/FINAL%20Equifax%20Report.pdf — Senate Permanent Subcommittee on Investigations staff report. 2015 patch audit, competitor comparison, disclosure delay, recordkeeping failure, 5 recommendations.
• "Equifax to Pay $575 Million as Part of Settlement with FTC, CFPB, and States Related to 2017 Data Breach" (2019-07-22) — https://www.ftc.gov/news-events/news/press-releases/2019/07/equifax-pay-575-million-part-settlement-ftc-cfpb-states-related-2017-data-breach — FTC press release. Settlement amounts, consumer relief, security obligations, and allegations in the complaint.
• "Equifax Announces Cybersecurity Incident Involving Consumer Information" (2017-09-07) — https://investor.equifax.com/news-events/press-releases/detail/240/equifax-announces-cybersecurity-incident-involving-consumer — Initial notice by the involved party, Equifax. Estimated damage, free products.
• "Equifax Releases Details on Cybersecurity Incident, Announces Personnel Changes" (2017-09-15) — https://investor.equifax.com/news-and-events/news/2017/09-15-2017-224018832 — Equifax timeline explanation and personnel announcements, waiver of freeze fees, clarification of terms.
• "Chinese Military Personnel Charged with Computer Fraud, Economic Espionage and Wire Fraud for Hacking into Credit Reporting Agency Equifax" (2020-02-10) — https://www.justice.gov/opa/pr/chinese-military-personnel-charged-computer-fraud-economic-espionage-and-wire-fraud-hacking — U.S. Department of Justice indictment announcement. Charges and the presumption of innocence statement.

Source Papers

• "Prior Fraud Exposure and Precautionary Credit Market Behavior" (2022, Federal Reserve Bank of Philadelphia Working Paper) — DOI: 10.21799/frbp.wp.2022.36 — Immediately following the Equifax announcement, individuals who had previously experienced identity theft or breaches engaged in credit freezes and card cancellations more frequently than those without experience, with past victims of identity theft doing so even more.
• "Who Responded to Equifax? Self-Protection Strategies When Guardians Fail" (2021) — DOI: 10.1080/15564886.2021.1876801 — A North Carolina public opinion poll. Computer usage did not predict self-protection measures after Equifax, and negative emotions regarding identity theft drove the actions.
• "Concern But No Action" (2018) — DOI: 10.1145/3170427.3188510 — Four preliminary interviews after Equifax. Participants viewed identity theft as a primary risk and had low perceived control, yet did not take sufficient protective measures.
• "Out of Sight, Out of Mind: Consumer Reaction to News on Data Breaches and Identity Theft" (2015, Federal Reserve Bank of Philadelphia Working Paper) — DOI: 10.21799/frbp.wp.2015.42 — The 2012 South Carolina Department of Revenue breach. Direct victims signed up for fraud prevention services in large numbers, while the reaction of those who only encountered news was minimal. Consumers respond to clear evidence of self-exposure.
• "Awareness, Intention, (In)Action: Individuals’ Reactions to Data Breaches" (2023) — DOI: 10.1145/3589958 — Survey of 413 people and follow-up with 108 people. 73% were caught in breaches, but 74% of those breaches were unknown to them, revealing an intention-action gap driven by apathy, cost, forgetfulness, and resignation, alongside the active notification and protection responsibilities of institutions.
• "You `Might' Be Affected" (2019) — DOI: 10.1145/3290605.3300424 — 161 breach notification letters. They are long and difficult, lower or obscure the likelihood of impact and risk, and rarely guide the urgency or effectiveness of actions.
• "Understanding and Improving Consumers' Adoption of Online Privacy-Protective Behaviors" (2022, Ph.D. Dissertation) — DOI: 10.7302/6914 — Inaction after a breach may be a poor judgment, but it can also stem from rational cost-benefit calculations or resignation in the face of constraints.
• "Risk and protective factors of identity theft victimization in the United States" (2020) — DOI: 10.1016/j.pmedr.2020.101058 — NCVS Identity Theft Supplement for 2012 and 2014 (N=128,419). All three identity theft subtypes are associated with experiences of government and corporate data breaches, while password changes and document shredding serve as protective factors.
• "The Consequences of Identity Theft Victimization: An Examination of Emotional and Physical Health Outcomes" (2016) — DOI: 10.1080/15564886.2016.1177766 — In addition to financial and time losses, victims experienced emotional (such as depression) and physical (deteriorating health) symptoms.
• "Nonfinancial Consequences of Identity Theft Revisited: Examining the Association of Out-of-Pocket Losses With Physical or Emotional Distress and Behavioral Health" (2024) — DOI: 10.1177/00938548231223166 — 1,557 victims. The time spent on resolution was associated with increased distress across all outcomes, and non-monetary consequences were a distinct phenomenon from financial losses.
• "Estimating the Social Cost of Corporate Data Breaches" (2026, preprint) — DOI: 10.48550/arxiv.2603.21270 — Accounting for a discovery delay of 1 to 2 months, identity theft increases significantly following major breaches, with the social cost of Equifax bounded between a lower limit of $263.8 million and an upper limit of $1.72 billion, interpreted through market saturation.
• "Do data breach disclosure laws reduce identity theft?" (2011) — DOI: 10.1002/pam.20567 — FTC panel data from 2002 to 2009. The introduction of notification laws reduced identity theft resulting from breaches by an average of 6.1%.
• "More Than a Suspect: An Investigation into the Connection Between Data Breaches, Identity Theft, and Data Breach Notification Laws" (2020) — DOI: 10.5325/jinfopoli.10.1.0045 — Bayesian modeling from 2005 to 2017. Correlations are driven by state size, notification laws reduce identity theft slightly, and state attorney general breach disclosures aid learning.
• "Do US State Breach Notification Laws Reduce Firm Data Breaches?" (2022, conference abstract) — DOI: 10.5465/ambpp.2022.11493abstract — Difference-in-differences from 2003 to 2018. No significant changes in the number or scale of breaches, or in the long-term rates of identity theft and fraud, with a federal system proposed.
• "Do data breach notification laws reduce medical identity theft? Evidence from consumer complaints data" (2022) — DOI: 10.1111/jels.12331 — A reduction of 3.5 medical identity theft complaints per 100,000 residents following California's 2016 notification standard (synthetic control).
• "Data Breach Announcements and Stock Market Reactions: A Matter of Timing?" (2022) — DOI: 10.1287/mnsc.2021.4264 — 2008 to 2018. Announcements cluster on news-heavy days (more common for severe, internal-cause, medical, and credential breaches), and news congestion weakens market reactions, with a median decline of $347 million versus $85 million.
• "It pays to be forthcoming: timing of data breach announcement, trust violation, and trust restoration" (2023) — DOI: 10.1108/intr-12-2021-0939 — Survey experiment. Late disclosures damage trust more severely, and even when restored through the provision of protection, companies that reported late remain trusted less.
• "Empirical Analysis of Data Breach Litigation" (2014) — DOI: 10.1111/jels.12035 — Over 230 federal breach lawsuits from 2000 to 2010. Financial damages increase the odds of being sued by 3.5 times, while offering free credit monitoring lowers it by 6 times.