An Equifax computer breach was made public last week and its costs remain unknown as 143 million customers may have been affected.
The company said a flaw in a tool designed to build web applications may have been at fault for the breach, CNN reported, adding that that Equifax knew about the security flaw two months before the company admitted that hackers first exploited it to gain customer data.
The tool, called Apache Struts, is used by Equifax and other large businesses and government organizations, CNN reported. Equifax used it to support its online dispute portal -- where its customers logged in issues with their credit reports.
CNN said a flaw in Apache Struts allowed hackers to take control of a website.
"The breach lasted from mid-May through July," Seena Gressin, an attorney with the Federal Trade Commission's division of consumer and business education said on one of its blogs. "The hackers accessed people's names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers.
"They also stole credit card numbers for about 209,000 people and dispute documents with personal identifying information for about 182,000 people. And they grabbed personal information of people in the (United Kingdom) and Canada too," Gressin continued.
Equifax announced in a statement last week that its chief information officer and its chief security officer were retiring but did not name them. The company said that Mark Rohrwasser was appointed interim chief information officer and Russ Ayres interim chief security officer in their place.
Equifax said in its statement that it created a dedicated website where consumers could understand whether they were impacted, find out more information about the breach, and learn how to protect themselves.
The company also has offered free credit file monitoring and identity theft protection to all U.S. consumers, regardless of whether they were definitively impacted.
Security experts told CNN that Equifax did not move fast enough to patch the problem in the software, leading to the exposure.
"There's really no excuse whether it's a difficult patch or not, for an organization of that size with that kind of magnitude of data," Jon Hendren, director of strategy at security firm UpGuard, told CNN. "When you're a big organization like that, it's a systemic failure of process and the blame goes straight to the top."
© 2025 Newsmax. All rights reserved.