Equifax disclosed the 2017 data breach affecting roughly 147 million people. Attackers exploited a known vulnerability in the company’s web application and accessed sensitive personal information.
Equifax announced the breach in September 2017, reporting that names, Social Security numbers, birth dates, addresses and, in some cases, driver’s-license numbers had been exposed. The company later revised the affected population to approximately 147.9 million people in the United States, Canada and the United Kingdom.
The incident caused major criticism of Equifax’s patching, security controls and public communication. In 2019, Equifax agreed to a settlement with U.S. regulators and consumers that could reach up to $700 million, including consumer compensation and government payments.
Equifax is one of the three major U.S. consumer credit bureaus, alongside Experian and TransUnion. The breach involved stored credit-file data, not a theft of credit scores alone.