Equifax Hackers Stole 200k Credit Card Accounts in One Fell Swoop
Summary: Visa and MasterCard sent confidential alerts to U.S. banks warning that more than 200,000 credit cards were stolen in the Equifax breach, with a stated exposure window of Nov. 10, 2016 to July 6, 2017. Equifax said the attacker accessed a storage table of historical card transaction data and downloaded it in one fell swoop in mid-May 2017, and confirmed the entry point was Apache Struts CVE-2017-5638, a flaw disclosed in March 2017.
Bottom line: Equifax patched the Apache Struts flaw only after taking the hacked systems offline on July 30, 2017, leaving them unpatched for more than four months after a fix and public exploit code were available. The stolen card data included account numbers, expiration dates and cardholder names, and Visa later said the records also included Social Security numbers and addresses.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Mentions
- CVE-2017-5638
- Related
- CVE-2017-5638: Apache Struts Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021