The 2017 Equifax data breach affected 145.5 million people, according to the company's revised estimate. Attackers exploited a known vulnerability in Apache Struts, a web application framework used by Equifax.
The intrusion began in May 2017 and remained undetected for weeks. The stolen information included names, Social Security numbers, birth dates, addresses, and, in some cases, driver's-license numbers and credit-card details.
Equifax initially reported that about 143 million U.S. consumers were affected, then increased the figure to 145.5 million after additional forensic review. The incident became a major example of how delayed patching can turn a software vulnerability into a large-scale data exposure.
The breach is often confused with a separate 2017 incident involving other companies. Equifax is a credit-reporting agency, not a bank, so the stolen records primarily concerned identity and credit-report information.