One unpatched web server. That is the entire story. Everything after it is just the body count.
In March 2017, the Apache Struts project disclosed a critical vulnerability, CVE-2017-5638, and shipped a fix in the same window. It was free. It was public. It came with a clear advisory. One of Equifax's web applications, a consumer dispute portal, was running a vulnerable version of Struts. The patch existed and sat there. Nobody applied it where it counted. By mid-May, attackers were already inside. They roamed for roughly 76 days before anyone at the company noticed.
When it was over, around 147 million people had their names, Social Security numbers, birth dates, and addresses exposed. The eventual settlement climbed to at least 700 million dollars. All of it traces back to a patch that someone left on the shelf.
One known CVE is usually all it takes
I come from penetration testing, so let me be blunt. When I scanned a target, I was not dreaming about some elegant zero-day. I was hoping to find exactly this. An outdated framework. A public CVE with a writeup and a proof of concept. A server somebody forgot to update. That is the actual bread and butter of real intrusions, not the hoodie-in-the-dark movie version.
CVE-2017-5638 was not exotic. It was in every scanner within days of disclosure. So here is the uncomfortable part. Equifax was not taken down by wizards. They were taken down by patience and an off-the-shelf scanner pointed at a box that should have been fixed months earlier. The attackers did not outsmart anyone. They just showed up on time.
The detail that still bothers me
Here is the piece most summaries skip. Equifax actually owned a device that inspected encrypted traffic, exactly the kind of tool that could have spotted the data leaving the building. But the certificate on that inspection device had expired. For something like nineteen months, it was effectively blind. When engineers finally renewed the certificate, the alerts fired almost immediately, and that is how the breach was discovered in the first place.
Sit with that for a second. The alarm was installed. The wiring was done. The battery was just dead, and no one checked for over a year. Your security tooling is not decoration you buy once and forget. A control you do not actively monitor is a control you do not actually have.
So why does this keep happening?
Patching is boring. That is the honest answer. It ships no feature. It wins no demo. It is a grey Tuesday chore that competes against a hundred louder priorities, and it loses that fight, right up until the single time it does not.
But boring and unimportant are not the same word. The gap between a CVE going public and an attacker weaponizing it is now measured in days, sometimes hours. Your asset inventory, the real list of what you run and which exact version, is itself a security control. If your team cannot answer "where do we run Struts, and which build" in five minutes, you have already lost the race before it started.
What I carry into every engagement
So here is what I actually do, and what I would tell any team that will listen. Know your inventory down to the dependency version. Automate your patching so that one tired human forgetting on a Friday is not a single point of failure. And then test that your alarms genuinely fire, because an expired certificate on a blind monitor is somehow more tragic than never having bought the monitor at all.
Equifax did not fall to a nation-state masterstroke. They fell to a to-do item. One line on somebody's backlog, quietly deprioritized, compounding into a 700 million dollar lesson for the rest of the industry.
The scariest exploits are almost never the clever ones. They are the ones you were already warned about, in writing, and decided to handle later.
I am Ksatria Bintang Samudra, an AI-native full-stack engineer with a penetration-testing background and a deep interest in digital forensics, open to remote work worldwide. More of what I build at ksatriabintangsamudra.com.
Top comments (0)