breaking news

Game time, TV set for Georgia Tech-Georgia game

Timeline of the hacking of Equifax


Ex-Equifax CEO Richard Smith told lawmakers Monday that “both human error and technology failures” opened the way for a massive hacking incident in which thieves got away with sensitive information on more than 145 million Americans. Here’s a chronology of what happened, based on his prepared testimony before a hearing Tuesday by the House Energy and Commerce Committee. Smith stepped down and retired from Equifax on Sept. 26.

Read additional coverage on myAJC.com.

March 8: The U.S. Department of Homeland Security warns Equifax and many other users that a patch is needed on software called Apache Struts to fix security weaknesses.

March 9: Equifax forwards the U.S. warning internally to its information security team and requests a fix within 48 hours, but the patch isn’t installed.

March 15: Equifax’s security team runs software scans that should have caught the weak spot in Apache Struts. But it doesn’t spot any vulnerable versions of the software. “It was this unpatched vulnerability that allowed hackers to access personal identifying information,” Smith said.

May 13: Hackers apparently get their first batch of sensitive data. “The company was not aware of that access at the time,” Smith said. Equifax doesn’t detect the ongoing attack for another two months plus.

July 29: Equifax’s security team sees “suspicious network traffic” tied to its website where consumers dispute alleged errors in their credit profiles or other problems. The team investigates and “immediately” blocks the traffic, Smith said. The website is shut down the next day when more questionable activity appears.

July 31: Equifax’s chief information officer tells Smith about the attack, and that the website was shut down. “I certainly did not know that personal identifying information … had been stolen, or have any indication of the scope of the attack,” Smith said. (Equifax’s CIO at the time of the hack, David Webb, retired in the wake of the scandal on Sept. 15.)

Aug. 2: Equifax hires King & Spalding to “guide the investigation” into the data breach, and calls the FBI. The Atlanta law firm hires cybersecurity consultant Mandiant to investigate the hacking incident.

Aug. 11: Mandiant and Equifax determine that hackers may have gotten “a large amount of consumers” sentive data, Smith said, from a separate database in addition to the attack on the complaint portal.

Aug. 15: Smith said he is told that “it appeared likely that consumer (data) had been stolen. He said he requested “a detailed briefing to determine how the company should proceed.”

Aug. 17: Smith meets with “a senior leadership team” on the hacking investigation. By this time, the company knows “large volumes of consumer data … had been compromised,” he said. “This information was deeply concerning to me, although the team needed to continue their analysis to understand the scope and specific consumers potentially affected.” (Equifax eventually concluded the total was 145.5 million people — most adult Americans.)

Aug. 22: Smith tells Mark Feidler on the company’s board of directors of the breach, as well as the heads of Equifax’s business units. The rest of the board is told of the situation on August 24-25 in conference call meetings. The company starts drawing up “remediation” plans for consumers. (Feidler was named Equifax’s interim chairman when Smith stepped down.)

Sept. 1: The Equifax board meets to discuss the scale of the attack, remediation plans, and the risk of “exponentially more attacks” by copycat hackers, Smith said.

Sept. 4: Equifax draws up a list of 143 million potentially affected consumers — later bumped up to 145.5 million — and sets up a call center and a website for consumers to check if their data is compromised, and to sign up for help. The FBI is told about Equifax’s plans to go public with the breach.

Sept. 7: Equifax discloses the massive breach after the stock market closes.

LEARN MORE

Kempner: Last assignment for Equifax’s ex? Survive Capitol Hill

http://www.myajc.com/business/kempner-last-assignment-for-equifax-survive-capitol-hill/fwVjMQ3O520bidJltGKnlM/ 

MYAJC.COM: REAL JOURNALISM. REAL LOCAL IMPACT.

AJC Business reporter Russell Grantham keeps you updated on the latest news about major companies, CEOs and public utilities in metro Atlanta and beyond. You'll find more on myAJC.com, including these stories:

Never miss a minute of what's happening in local business news. Subscribe to myAJC.com.



Reader Comments ...


Next Up in Business

Business stories of the week: Amazon, 2018 priorities, Phipps Plaza
Business stories of the week: Amazon, 2018 priorities, Phipps Plaza

The week had no shortage of business headlines among Atlanta area companies – or perhaps companies that want to become Atlanta area companies. From the Amazon second headquarters search to major development projects, here are some of the big business headlines you might have missed from the past week. Georgia and Atlanta area economic development...
More job cuts coming to Atlanta as part of Coca-Cola restructuring
More job cuts coming to Atlanta as part of Coca-Cola restructuring

Atlanta-based Coca-Cola plans to cut an additional 179 jobs in its hometown as part of a broader restructuring the beverage giant announced earlier this year. In filings with the Georgia Department of Economic Development’s Workforce Division, Coke identified layoffs at three corporate offices in the city effective by the end of December...
Atlanta’s Phipps Plaza makeover plan shifts into overdrive
Atlanta’s Phipps Plaza makeover plan shifts into overdrive

The reinvention of Phipps Plaza into a mixed-use entertainment and shopping complex has been in the works for more than a decade. But the announcement Tuesday of a $200 million-plus expansion, including a flagship Nobu hotel and restaurant, will take that the makeover to a new level, officials with mall owner Simon hope. In Nobu, Phipps will add...
4 of the best ways to turn your home into a cash cow
4 of the best ways to turn your home into a cash cow

Your house is a large expense with many associated costs like a mortgage payment, insurance, maintenance and more. It provides a roof over your head, of course, but since it usually costs you money each month, why not put it to work for you and earn some cash in the process? The following are four ways your house can make you money: If you're planning...
6 things to know about working for Uber
6 things to know about working for Uber

Uber has been making headlines in recent months for everything from a new CEO to industry regulation. But if you want to work as a driver for the service that revolutionized the taxi-transport industry, there is more important information about Uber you'll want to check out. Here are six things you need to know about Uber before working for them...
More Stories