Equifax Atlanta HQ. Photo: John Disney/ALM

The U.S. House of Representatives Committee on Oversight and Government Reform released a report Monday that concluded the 2017 Equifax Inc. data breach that exposed the personal information of about 148 million consumers was entirely preventable.

Data privacy and cybersecurity attorneys interviewed Tuesday generally agreed with that assessment, however, at least one prominent data privacy and security lawyer said that she believed the report was unfair to the company, because the government has done little to help protect U.S. companies and organizations from bad actors.

“The Congressional report states that the breach was entirely preventable, but that seems to dismiss the fact that companies are under attack every day from foreign adversaries. It would be really good to see Congress talk about what Congress can do to help protect companies as opposed to just re-victimizing the victims,” said New York-based Morrison & Foerster partner and privacy co-chair Miriam Wugmeister, who is not representing Equifax. Wugmeister has spent years advising U.S. and multinational companies on data privacy and security and data breach response.

The congressional committee report disclosed that “after updating the security certificate, Equifax employees identified suspicious traffic from an IP address originating in China” and that “Equifax noticed additional suspicious traffic from a second IP address owned by a German ISP, but leased to a Chinese provider.”

According to the report, In March 2017, a software vulnerability was publicly disclosed that required a patch on Atlanta-based Equifax operating systems. In May 2017, hackers began a cyberattack on Equifax that lasted for 76 days. The intruders were able to access 48 databases during the attack. On July 31, former Chief Information Officer David Webb told former CEO Richard Smith about the incident and about how they suspected the vulnerability was exploited by the hackers during the data breach. On August 2, Equifax engaged the cybersecurity firm Mandiant to investigate, and Equifax notified outside counsel and the Federal Bureau of Investigation. By late August 2017, Mandiant confirmed that attackers had accessed a large amount of personally identifiable information, and Equifax started to prepare to make a public notice about the breach and constructed a website for consumers to find out if they were affected and if so, to access credit monitoring. Equifax actually notified the public about the breach Sept. 7, nearly four months later, according to the report.

The sheer size of the breach and delayed notification led to public and media outcry, and calls for government hearings and action by state attorneys general and other authorities.

The congressional report stated that Equifax should have addressed “at least two points of failure to mitigate, or even prevent, this data breach.” It said there was a lack of accountability and that no clear lines of authority in Equifax's IT management structure existed. It further stated that Equifax's “aggressive growth strategy and accumulation of data resulted in a complex IT environment.” The complexity of Equifax's IT system made IT security difficult. Further, Equifax did not know what kind of software was being used in its legacy environments. The lack of knowledge about its software was what led to a vulnerability being exploited by hackers, according to the report.

In a statement emailed to this reporter, an Equifax spokesperson said the company was disappointed they did not have an adequate amount of time to review and respond to the report before it was published. 

“During the few hours we were given to conduct a preliminary review before they released it yesterday, we identified significant inaccuracies and disagree with many of the factual findings,” the statement said. Those inaccuracies, according to the Equifax spokesperson, include the idea that Equifax did not disclose any cybersecurity risks in its SEC filings prior to the 2017 data breach. The spokesperson said the company's 10-K reports addressed cybersecurity risk factors. The report further references a settlement with state attorneys general when the settlement has not occurred, according to the spokesperson. 

Edward McAndrew, a partner at Ballard Spahr in Philadelphia, said the report serves as a reminder for companies that interpersonal relationships play a large part in protecting data and networks.

“The problematic IT structure is really important because it does explain why or provides the context as to how Equifax really failed at something as basic as patching,” McAndrew said. “You see this siloing within their IT structure from the security side of the house and the information technology side of the house.”

McAndrew explained that information technology and security are not the same thing, but at Equifax information technology and security were not in the same room and did not report to the same people.

Mark McCreary, the chief privacy officer and a partner at Fox Rothschild in Philadelphia, said he was pleased the report did not hold back in criticizing Equifax's network security.

“In speaking with the IT professionals in my world, all of them agreed that it is almost a certainty that there must have been numerous conversations regarding the flaws in existing technology and failures to keep technology and security solutions up-to-date.  I understand that their consumer-facing system was nearly 50 years old and the breach point was a well-known issue with Apache Struts that has a fix widely available,” said in an email.

McCreary said that, in his view, the biggest takeaway from the report is that business must patch their systems.

“I felt the biggest takeaway from the report for a business is almost cliché but often undervalued.  Businesses must patch their systems.  Often it is that simple.  The great things for executives is that they do not need to do much more than direct, empower and fund their information technology departments to be able to do those patches,” McCreary said in the email.

Read more:

Federal Data Privacy Legislation Is Likely Next Year, Tech Lawyers Say

Equifax Agrees to New Data Breach Safeguards in Consent Order With State Regulators

New York Takes the Lead on Cybersecurity Regulation

NYS DFS Issues Sweeping New FAQs Affecting Scope of Its Cybersecurity Regulations