Equifax Data Breach (IT & Computer Science Case Study)

Case Study
Students’ Name:
University Affiliation:
Course:
Date of Submission:
Date Breach at Equifax
Background
Incidences of data breach expose confidential or protected data to criminals and untrusted individuals. A data breach may involve the theft of security codes, bank account, credit card code, passwords and personal medical information. The breach may be intentional or unintentional by employees, former employees, hackers and business competitors. Data breaches grab significant portion of headlines on our screens daily, with the recent Equifax breach depicting one of the massive impacts of data breaches in the telecommunication industry. The Equifax data breach occurred in March 2017 when several Equifax consumers’ identification data were stolen from the company’s website. The company had quite an excellent reputation as a credit report agency of all times in the United States, Canada, and the U.K (Srinivashan, Pitcher & Goldberg, 2020). The incident spawned a lot of scandals and controversies as the firm suffered from several criticisms. The consumers condemned their lax safety posture, corrupt executives, and the critiques reached uproar when they delayed the address on the breach. The delayed address made the whole incident questionable on who was behind the breach and escalated the implications to the company.
The Occurrence of the Breach
According to an investigation, the Equifax data breach resulted from the firms’ multiple security failures, which paved the way for cybercriminals. The investigation concluded that several security lapses promoted the attack on the supposed secure systems. The investigators also reported an earlier attack where the attackers utilized the widely known vulnerability on the consumer complaint portal (Srinivashan, Pitcher & Goldberg, 2020). Due to failures within the management of Equifax, the vulnerability was not patched. The culprits then navigated through diverse servers since the systems were not sufficiently segmented, and they were able to access usernames and system passwords stored on plain texts. The attackers used the unsecured logins to access other systems and dragged information from the network in an undetectable encrypted format. The company had failed to renew its’ encryption subscription fee and certificate on its internal security tools, making it easier for the attackers. The incident occurred after a series of securities faults that were ignored by the firm.
The company dealt with traffics in personal data that was compromised and spirited away by the culprits. Many American citizens, about 143 million, suffered from the loss, including those from Canada and the United Kingdom. The data lost included names, personal addresses, and dates of birth, drivers’ licenses number, credit card numbers, bank details, and social security passwords. The credit card numbers lost consisted of individuals who had paid to monitor their credit reports. After the breach was made public, Equifax made a distinct domain, ‘equifaxsecurity2017.com,’ which was supposed to hold information and resources for the adversely affected clients. However, their strategy was not successful because such lookalike domains are t...