In 2017, Equifax, one of the largest credit reporting companies in the world, faced an enormous hack and data breach. Now in 2020, the individuals responsible are facing charges for the attack. 



Flashback to 2017

To begin, last week, the DOJ accused four members of the People’s Liberation Army in China of performing the hack against Equifax. After releasing the nine-count indictment regarding the breach, the document portrays how the members allegedly pulled off one of the largest hacks in US history.

Now, before we get into the indictment, let’s take a look back at how the attack on Equifax went down. 


The Hack

On September 17th, 2017, Equifax released a public statement acknowledging the data breach. In that announcement, the company reveals that over 140 million customers will be affected by the breach. 

Next, this meant that an abundance of personally identifiable information (PII) became available to hackers, and could be used maliciously. 

Following the breach, the company now has resources for customers to check to see if they were actually affected in the breach. Further, the company took action to notify affected customers. 

Continuing, millions of people went into a panic due to the possibility of their personal information being at risk.


The Settlement

After the dust somewhat settled and the company began attempts to recover, everyone’s next thought is the settlement for the case. 

To elaborate, Equifax agreed to a global settlement with the Federal Trade Commission (FTC). Next, the total of the settlement came to 425 million dollars, in order to help those affected by the breach.

Further, the cutoff to file a claim for the breach has recently ended as of January 22, 2020. 

Although, options are still available for victims to file a claim from January 23, 2020 to January 22, 2024.


The Equifax Indictment

To get started, let’s bring the timeline back to February 2020. The DOJ is now in the proceedings of an indictment against the accused four in the hack. 

The four alleged attackers are Xu Ke, Wu Zhiyong, Wang Qian, and Liu Lei. All belong to a part of a component of the Chinese military called PLA’s 54th Research Institute.

The attackers were able to gain access to the sensitive customer information by exploiting a “vulnerability in the Apache Struts Web Framework software used by the credit reporting agency’s online dispute portal” (via Naked Security). 

Finally, once the attackers had access through that vulnerability, they used the opening to venture onto the rest of the network. Their actions included stealing trade secrets, including other data and infrastructure design.

Where does that leave everything now? The attacker’s trial is currently being held in the US, and the general public will await more news as the proceedings are carried out. 


Stay tuned.


By Taylor Ritchey



Firstly/secondly, further, and, moreover, in addition