Data Protection: Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach
Released: 2018-09-07T00:00:00

Letter

Background

A consumer reporting agency is a person or entity that assembles or evaluates consumer credit information or other consumer information for the purpose of furnishing consumer reports to others. This includes companies that compile and store electronic files of consumer information, which they then sell to other businesses and organizations that use the information to assess or evaluate creditworthiness.

Furnishing of information by creditors and others to CRAs is voluntary, as federal law generally does not require such reporting, and information compiled on individual consumers can vary among the CRAs. A lender uses the information provided to determine whether to offer credit to an individual, the rate of interest to be assigned to the loan, and other terms of the contract. In addition, a growing number of entities use information provided by CRAs to help make decisions about individuals’ credit worthiness when determining eligibility for insurance, housing, or employment, among other things. Information from CRAs can also be used for other purposes, such as to identify potential customers with specific characteristics for new credit card accounts.

CRAs may provide a variety of verification services to government and private sector organizations. For example, Equifax provides income and employment verification services using information collected from employers.

Equifax, TransUnion, and Experian—the three major CRAs—also leverage information they collect from organizations, such as financial institutions, utilities, cell phone service providers, public records, and government sources, to offer identity verification services. Other entities, including federal agencies, use identity verification when they enroll new applicants for benefits and services. In addition, the IRS uses identity verification to ensure that individuals who want to access prior year tax returns are the legitimate filers of those returns.

With regard to identity verification, CRAs typically use information they collect to generate questions that federal agencies and other entities can use to test applicants’ knowledge of information in their credit file. These questions and answers are typically the basis for identity proofing—the process of comparing evidence from an individual with a trusted source of data to verify that the individual is who they claim to be. The evidence generally consists of information or documentation that only the legitimate individual should know or have access to. For example, a driver’s license, passport, knowledge of recent financial transactions, and biometric information are all considered relatively strong evidence that the individual is who they say they are.

A Data Breach Can Have Harmful Results

Although there is no commonly agreed-upon definition, the term “data breach” generally refers to an unauthorized or unintentional exposure, disclosure, or loss of an organization’s sensitive information. This information can include PII, such as Social Security numbers, or financial information, such as credit card numbers.

A data breach can occur under many circumstances and for many reasons. It can be inadvertent, such as from the loss of an electronic device, or deliberate, such as from the theft of a device. A breach can also occur as a result of a cyber-based attack by a malicious individual or group, agency insiders, foreign nation, terrorist, or other adversary. Data breaches have occurred at all types of organizations, including private, nonprofit, and federal and state entities.

The loss or unauthorized disclosure of information in a data breach can lead to serious consequences and can result in substantial harm to individuals, private sector organizations, and the federal government. Examples of harmful results include: loss or theft of resources, including money and intellectual property, and identity theft; inappropriate access to and disclosure, modification, or destruction of sensitive information; harm to national security; use of computer services for unauthorized purposes or to launch an attack on other computer systems; damage to networks and equipment; loss of privacy, emotional distress, or reputational harm; loss of public confidence; and high costs to remediate the effects of the breach.

Attackers Use a Variety of Tools and Techniques

Cyber criminals seeking access to sensitive information, such as PII, typically use a variety of readily available software tools to carry out attacks. These tools can be used to intercept and capture data as they are transmitted, exploit known vulnerabilities in commercially available software, and facilitate e-mail phishing techniques for gaining unauthorized access to systems and information.

Attackers often use similar techniques and tools, making it difficult to distinguish one attacker from another. When custom-built tools are used, an attacker may rely on unique methods or display other telltale signs that can be used for identification; such tools are usually used when a target’s defenses justify them. Off-the-shelf tools are usually enough to conduct a successful attack that allows an attacker to steal data, bring systems down, or gain further access to systems and resources.

Attackers often begin with network-scanning programs, which are used to map the layout of a targeted network and determine the location of data repositories that may contain information of interest. Some scanners are designed to scan only a single networked computer, extracting as much data about that system as possible. Others can scan Internet addresses across the web to identify potential targets by determining whether they are using a version of software that is vulnerable to an attack.

Once a target has been identified, the attacker will generally attempt to gain access to the system or network without leaving any indication of who they are or from where they launched their attack. This is commonly accomplished using tools that mask the attacker’s origin by using the Internet address of another computer from another location. While an investigator can sometimes use forensic tools to trace the original Internet address, often this leads to misleading information.

Attackers use additional tools and techniques to gain unauthorized access to systems and data on the target network and to transfer stolen data back to the attacker’s own computer system. One such technique is to leverage the access rights gained on the originally compromised system to get further access into other servers on the network. To do this, an attacker can use standard, off-the-shelf tools for navigating systems and managing information that blend in with normal network activity. For example, encryption can be used to hide the transfer of sensitive information from one server to another or out of the network entirely. This enables the attacker to continue probing for more repositories of information and stealing copies of that information without being detected by the targeted network’s system administrators.

Federal Agencies Oversee CRA Activities, Including Protection of Personally Identifiable Information

CRAs have been subject to federal regulation since the passage of the Fair Credit Reporting Act in 1970. Currently, FTC and BCFP are the two federal agencies with primary oversight responsibilities for CRAs. FTC was given responsibility for administratively enforcing CRAs’ compliance with the Fair Credit Reporting Act at the time of enactment. As part of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd- Frank Act), BCFP was given authority to enforce a number of federal consumer financial laws, including the Fair Credit Reporting Act. BCFP also has begun exercising supervisory authority over certain larger participants in the credit reporting market.

FTC Has Enforcement Authority over CRAs

FTC has authority, subject to certain exceptions, to investigate any organization that maintains consumer data and to bring enforcement actions for violations of laws that concern the protection of consumer information. FTC also exercises enforcement authority over CRAs through the Gramm-Leach-Bliley Act and the related “Safeguards” and “Privacy Rules.”

The Fair Credit Reporting Act promotes the accuracy, fairness, and privacy of information collected or used to help make decisions about individuals’ eligibility for credit, insurance, employment, housing, or other benefits. CRAs that compile credit histories and other personal information into consumer reports must adhere to the act’s provisions for ensuring the accuracy and permissible uses of such information.

The Gramm-Leach-Bliley Act requires that federal financial regulators and FTC establish standards and protections to ensure the security and confidentiality of customer information. These standards and protections must be implemented by companies of all sizes that are engaged in financial activities, including Equifax and all other CRAs. Further, the act requires financial institutions to protect the security of customers’ personal information.

As part of its implementation of the Gramm-Leach-Bliley Act, FTC issued the “Safeguards Rule”, which requires financial institutions develop, implement, and maintain a comprehensive information security program to keep information about a customer of a financial institution secure and confidential. In addition to developing their own safeguards, companies covered by the rule are responsible for requiring their affiliates and service providers to implement and maintain safeguards to protect customer information in their care.

In determining whether it should take enforcement action against a company for a violation of data security provisions, FTC considers a number of factors, including whether a company’s data security measures are commensurate with the company’s size. FTC does not have supervisory authority to examine CRAs for compliance with the Federal Trade Commission Act; therefore, the agency typically must rely on its enforcement authority after an incident has occurred.

Finally, FTC enforces Section 5 of the Federal Trade Commission Act, which prohibits “unfair or deceptive acts or practices in or affecting commerce.” FTC officials told us that failing to properly protect consumer data can be considered an unfair or deceptive act or practice.

BCFP Has Enforcement and Supervisory Authorities over CRAs

In 2010, the Dodd-Frank Act gave BCFP enforcement authority over all CRAs and certain other persons for violations of most provisions of the Fair Credit Reporting Act; certain provisions of the Gramm-Leach-Bliley Act; and for unfair, deceptive, or abusive acts or practices under sections 1031 and 1036 of the Dodd-Frank Act. BCFP has taken enforcement actions against CRAs for violations of the Fair Credit Reporting Act and for deceptive practices.

In 2012, BCFP also extended its supervisory authority to include larger CRAs—that is, those with more than $7 million in annual receipts from consumer reporting activities. BCFP staff review certain of these larger CRAs on an ongoing basis, and BCFP staff said that their recent examinations of CRAs have focused on compliance with Fair Credit Reporting Act requirements related to accuracy and resolving consumer disputes. BCFP has also examined CRAs subject to the BCFP’s supervisory authority for compliance with other Fair Credit Reporting Act requirements, including those related to ensuring the accuracy of information in consumer reports, furnishing information only to those with a permissible purpose, and compliance with the consumer dispute process.

BCFP also has supervisory authority over some aspects of the Gramm- Leach-Bliley Act. For example, BCFP examines larger CRAs for whether they restrict the sharing and disclosure of nonpublic personal information to third parties. BCFP does not have supervisory or enforcement authority over the “Safeguards Rule” enacted by FTC as part of the agency’s implementation of the Gramm-Leach-Bliley Act.

Finally, BCFP has authority to examine larger CRAs for any unfair, deceptive, or abusive acts or practices and to bring enforcement actions against CRAs of all sizes for such acts or practices. According to BCFP staff, in some cases, a CRA could commit an unfair, deceptive, or abusive act or practice or violation of other applicable law in connection with its data security practices.

GAO Has Previously Reported on Data Protection Issues

We have previously made recommendations to agencies regarding the protection of PII, and proposed Matters for Congressional Consideration in areas where laws could be enhanced. For example, in our recent report on data oversight at the Centers for Medicare and Medicaid Services (CMS), we recommended that the agency ensure that all third parties that receive CMS data have clear requirements for the protection of that data, that CMS properly oversee the implementation of those requirements, and that the agency ensure identified issues are remediated. Additionally, our recent report on the oversight of students’ PII at the Department of Education included seven recommendations for better protection of student PII and for improving department policies to meet federal privacy guidelines. All of these recommendations currently remain open while the agencies take actions to address them.

In addition to recommendations for agencies, we have proposed two Matters for Congressional Consideration related to data protection. In 2008, we reported that the Privacy Act and E-Government Act of 2002 may not adequately ensure that consumers are notified in the event of a breach by federal agencies and that existing laws could better ensure that consumers are aware of what PII federal agencies collect and how they use it. Based on this finding, we suggested that Congress consider amending applicable laws to ensure that all PII collected by federal agencies is protected and that its use is limited to the stated purpose of the collection.

With regard to data collected by private entities, in 2013, we reported that existing federal laws provide consumers with only limited protection for data that is collected and used for marketing purposes. Consequently, we asked Congress to consider strengthening the current consumer privacy framework to reflect the effects of changes in technology and the marketplace while also ensuring that any limitations on data collection and sharing do not unduly inhibit the economic and other benefits to industry and consumers that data sharing can accord.

Attackers Exploited Vulnerabilities That Equifax Subsequently Reported Taking Actions to Address

In March 2017, unidentified individuals discovered the presence of a known vulnerability in software running on Equifax’s online dispute portal that could be used to obtain access to the system. In May of that year, attackers exploited the vulnerability and began to extract data containing PII from Equifax’s information systems. According to Equifax, the attackers used a number of techniques to disguise their exploit of the Equifax systems and the database queries they conducted. On July 29, 2017, Equifax discovered the breach and reported that it took actions to address the factors that allowed the attackers to successfully gain access to its network. Further, the company reported that it took steps to identify, notify, and provide support to individuals who were potentially impacted by the breach.

Attackers Identified and Exploited Vulnerabilities to Steal Data

Equifax has stated that, on March 10, 2017, unidentified individuals scanned the company’s systems to determine if the systems were susceptible to a specific vulnerability that the United States Computer Emergency Readiness Team had publicly identified just 2 days earlier. The vulnerability involved the Apache Struts Web Framework and would allow an attacker to execute commands on affected systems.

Equifax officials stated that, as a result of this scanning, the unidentified individuals discovered a server housing Equifax’s online dispute portal that was running a version of the software that contained the vulnerability. Using software they obtained from an unknown source and that was designed to exploit the vulnerability, the unidentified individuals subsequently gained unauthorized access to the Equifax portal and confirmed that they could run commands. No data was taken at this time.

According to Equifax officials, beginning on May 13, 2017, in a separate incident following the initial unauthorized access, attackers gained access to the online dispute portal and used a number of techniques to disguise their activity. For example, the attackers leveraged existing encrypted communication channels connected to the online dispute portal to send queries and commands to other systems and to retrieve the PII residing on the systems. The use of encryption allowed the attackers to blend in their malicious actions with regular activity on the Equifax network and, thus, secretly maintain a presence on that network as they launched further attacks without being detected by Equifax’s scanning software.

Equifax officials added that, after gaining the ability to issue system-level commands on the online dispute portal that was originally compromised, the attackers issued queries to other databases to search for sensitive data. This search led to a data repository containing PII, as well as unencrypted usernames and passwords that could provide the attackers access to several other Equifax databases. According to Equifax’s interim Chief Security Officer, the attackers were able to leverage these credentials to expand their access beyond the 3 databases associated with the online dispute portal, to include an additional 48 unrelated databases.

After reviewing system log files that recorded the attackers’ actions, Equifax officials determined that the attackers then ran a series of queries in an effort to try to extract PII from the databases they had located. Altogether, the attackers ran approximately 9,000 queries, a portion of which successfully returned data containing PII. As before, Equifax officials stated that the attackers were able to disguise their presence by blending in with regular activity on the network.

After successfully extracting PII from Equifax databases, the attackers removed the data in small increments, using standard encrypted web protocols to disguise the exchanges as normal network traffic. The attack lasted for about 76 days before it was discovered. Figure 1 depicts an analysis of how the attackers gained access into Equifax’s systems and exploited vulnerabilities.

After Becoming Aware of the Attack, Equifax Took Steps to Block the Attackers

Equifax’s assessment of the data breach began with actions it took to identify that it was being attacked as well as subsequent actions to block the intrusion. Equifax officials stated that, on July 29, 2017— approximately 2.5 months after the attackers began extracting sensitive information on May 13, 2017—security personnel conducting routine checks of the operating status and configuration of IT systems detected the intrusion on the online dispute portal.

As reported by Equifax, a network administrator conducting routine checks of the operating status and configuration of IT systems discovered that a misconfigured piece of equipment allowed attackers to communicate with compromised servers and steal data without detection. Specifically, while Equifax had installed a device to inspect network traffic for evidence of malicious activity, a misconfiguration allowed encrypted traffic to pass through the network without being inspected. According to Equifax officials, the misconfiguration was due to an expired digital certificate. The certificate had expired about 10 months before the breach occurred, meaning that encrypted traffic was not being inspected throughout that period. As a result, during that period, the attacker was able to run commands and remove stolen data over an encrypted connection without detection.

Equifax officials stated that, after the misconfiguration was corrected by updating the expired digital certificate and the inspection of network traffic had restarted, the administrator recognized signs of an intrusion, such as system commands being executed in ways that were not part of normal operations. Equifax then blocked several Internet addresses from which the requests were being executed to try to stop the attack.

Equifax reported that, on July 30, 2017, after its information security department observed additional suspicious activity continuing to occur, the online dispute portal was taken offline. The next day, the Chief Security Officer, in coordination with internal stakeholders, informed the Chief Executive Officer of the attack on the portal.

Equifax Identified Several Factors That the Attacker Exploited During the Breach

To further assess the scope of the breach and identify its causes, Equifax began an investigation to identify the vulnerabilities that had been exploited to steal PII from its systems. Concurrent with this effort, company officials stated that they also began examining the data repositories that had been accessed to try to determine how much data had been taken and how many individuals were potentially impacted. According to Equifax officials, the investigation took place between August 2 and October 2, 2017, with the help of an external cybersecurity consultant.

Equifax officials stated that the company’s investigation was facilitated by the use of electronic logs that had not been damaged or erased by the attackers on the affected systems. These logs recorded commands that were issued by the attackers throughout the attack, such as commands to retrieve or display the contents of data repositories. By examining the logs, Equifax worked to reconstruct the sequence of specific actions that the attackers had taken and, consequently, determine what specific data had been compromised. In addition to initiating its internal investigation, on August 2, 2017, the company notified the Federal Bureau of Investigation of the breach.

Based on its cybersecurity consultant’s analysis and recommendations following the breach, Equifax determined that several major factors had facilitated the attackers’ ability to successfully gain access to its network and extract information from databases containing PII. Specifically, Equifax officials told us that key factors that led to the breach were in the areas of identification, detection, segmentation, and data governance: Identification. According to Equifax officials, the Apache Struts vulnerability was not properly identified as being present on the online dispute portal when patches for the vulnerability were being installed throughout the company. After receiving a notice of the vulnerability from the United States Computer Emergency Readiness Team in March 2017, Equifax officials stated that they circulated the notice among their systems administrators. However, the recipient list for the notice was out-of-date and, as a result, the notice was not received by the individuals who would have been responsible for installing the necessary patch. In addition, Equifax officials stated that although the company scanned the network a week after the Apache Struts vulnerability was identified, the scan did not detect the vulnerability on the online dispute portal.

Detection. As reported by Equifax officials, an expired digital certificate contributed to the attackers’ ability to communicate with compromised servers and steal data without detection. Specifically, while Equifax had installed a tool to inspect network traffic for evidence of malicious activity, the expired certificate prevented that tool from performing its intended function of detecting malicious traffic.

The certificate had expired before May 2017, meaning that traffic was not being inspected throughout the breach.

Segmentation. Because individual databases were not isolated or “segmented” from each other, the attackers were able to access additional databases beyond the ones related to the online dispute portal, according to Equifax officials. The lack of segmentation allowed the attackers to gain access to additional databases containing PII, and, in addition to an expired certificate, allowed the attackers to successfully remove large amounts of PII without triggering an alarm.

Data Governance. Data governance includes setting limits on access to sensitive information, including credentials such as usernames and passwords. According to Equifax officials, the attackers gained access to a database that contained unencrypted credentials for accessing additional databases, such as usernames and passwords. This enabled the intruders to run queries on those additional databases.

In addition to these four broad categories, Equifax officials noted one other factor that also facilitated the breach. Specifically, the lack of restrictions on the frequency of database queries allowed the attackers to execute approximately 9,000 such queries—many more than would be needed for normal operations.

Equifax Reported Taking Steps to Strengthen its Cybersecurity Controls

According to Equifax’s public filings, including its annual 10-K filing submitted to the Securities and Exchange Commission in March 2018 and its notice of 2018 annual meeting and proxy statement, following the 2017 incident, Equifax undertook a variety of remediation efforts to address the factors identified in their investigation. Equifax officials responsible for coordinating the response to the incident stated that, once the company identified how the attackers were able to gain unauthorized access to company systems and remove sensitive data, it took measures to address the internal factors that led to the breach. The measures were intended to better protect the company’s infrastructure from future disruptions, compromises, or failures. We did not independently assess Equifax’s efforts to address the identified factors.

Specifically, Equifax officials stated that system-level remediation measures were implemented to address the factors that led to the breach. For example, to work toward addressing concerns about identifying vulnerable servers, Equifax reportedly is implementing a new management process to identify and patch software vulnerabilities and confirm that vulnerabilities have been addressed. Also, to help ensure that detection of malicious activity is not hindered in the future, Equifax officials said they have developed new policies to protect data and applications and implemented new tools for continuous monitoring of network traffic. Further, in an effort to improve segmentation between devices that do not need to communicate, Equifax officials stated that they have implemented additional controls to monitor communications at the external boundary of the company’s networks and added restrictions on traffic between internal servers. Finally, to help address data governance issues, the officials said they were implementing a new security controls framework and tighter controls for accessing specific systems, applications, and networks.

In addition to these measures, Equifax stated that they implemented a new endpoint security tool to detect misconfigurations, evaluate potential indications of compromise, and automatically notify system administrators of identified vulnerabilities. Further, Equifax officials reported that the company has implemented a new governance structure to regularly communicate risk awareness to Equifax’s board of directors and senior management. The new structure requires the company’s Chief Information Security Officer to report directly to the Chief Executive Officer. Officials said this should allow for greater visibility of cybersecurity risks at top management levels.

Equifax Reported Taking Steps to Identify Affected Individuals

Following the shutdown of its online dispute portal, Equifax took steps to identify what data had been lost and the number of individuals affected so that it could fulfill its responsibility to notify affected individuals. To develop its estimate of the number of individuals affected by the data breach, Equifax stated that it recreated the attackers’ database queries on a separate system that could run the queries at high speed, allowing Equifax to generate its estimate in a relatively short period of time. Equifax staff then worked to reconstruct queries against the data tables to identify which queries had successfully extracted data and which individuals were associated with that data.

However, as is commonly experienced with large breaches, Equifax faced challenges in determining exactly how many individuals were affected. According to Equifax officials, much of the stolen data consisted of incomplete records without full sets of identifying information. Some data sets included information that could be matched to more than one known individual. Subsequently, Equifax officials stated that they compared these data sets with information in the company’s internal databases that were not impacted by the data breach to make matches with known identities.

For example, Equifax took partial records that did not include all fields and ran an analysis to determine whether Social Security numbers and names included in the records could be matched with those in Equifax’s core credit reporting databases. In addition, Equifax performed analyses to remove duplicates and to determine whether a person could be linked to incomplete records based on Social Security numbers. After Equifax completed its initial analysis of the datasets, it estimated that approximately 143 million U.S. consumers had been affected by the breach.

Moreover, Equifax’s initial analysis, reported on September 7, 2017, indicated that multiple types of PII had been compromised, including individuals’ names, Social Security numbers, birth dates, addresses, and driver’s license numbers. Because many of the records were incomplete, not all of the types of PII had been compromised for all affected individuals.

In addition, Equifax determined that credit card numbers for approximately 209,000 consumers and certain dispute documents, which had included PII for approximately 182,000 consumers, had been accessed. These documents contained PII associated with specific items from dispute cases that were submitted to Equifax as evidence supporting disputes they filed about the accuracy of their credit reports, such as utility bills.

Equifax made two revisions over time to its estimate of affected individuals. First, in late September 2017, Equifax determined that it had incorrectly concluded that one of the attackers’ queries had not returned any data. After additional analysis, including a determination that the query had, in fact, allowed the attackers to access PII from approximately 2.5 million additional U.S. consumers, Equifax revised the number of affected individuals from 143 million to 145.5 million on October 2, 2017.

Second, on March 1, 2018, Equifax stated that it had identified approximately 2.4 million U.S. consumers whose names and partial driver’s license information were stolen. The newly identified individuals were based on names and partial driver’s license information contained in a data table that Equifax had not previously identified as including individuals compromised in the breach. According to Equifax officials, Equifax’s original investigation had not identified these individuals because their names and partial driver’s license information were not stolen together with their Social Security numbers.

To identify as many potentially affected individuals as possible, Equifax contracted with a third-party data source that had access to a driver’s license database and mapped the partial driver’s licenses to an Equifax database containing Social Security numbers. According to Equifax officials, some of the individuals within this group of 2.4 million were already included in the previous total of 145.5 million affected individuals, while others were not. As of August 2018, Equifax had not determined exactly how many of the 2.4 million individuals were included in the previous total of 145.5 million.

Equifax Notified Affected Individuals and Offered Monitoring Services

On September 7, 2017, after Equifax had determined the extent of the breach and developed a remediation plan for potentially impacted consumers, the company provided written notification to all U.S. state attorneys general regarding the approximate number of potentially affected residents in each state and its plans for consumer remediation. The notification included steps individuals could take to determine if they were affected by the breach and to help protect against misuse of their personal information. The company also issued a press release to the public providing information about the breach and the types of PII that had been compromised.

Further, the press release issued on September 7, 2017, stated that the company had set up a dedicated website to help individuals determine if their information might have been stolen in the breach. In addition, Equifax improved the search tool it had developed to help U.S. consumers determine if they were impacted and expanded its call center operations. However, the website experienced several technical issues, including excessive downtime and inaccurate data. Equifax officials acknowledged these shortcomings and said they took measures to address them, including improving the stability of the website and accuracy of the information it provided.

Additionally, Equifax reported that it would provide several services to all U.S. consumers, regardless of whether their information had been compromised, free of charge for one year. Those services included credit monitoring, individual copies of Equifax credit reports, notification of changes to credit reports, a credit “lock” allowing individuals to prevent third-parties from accessing their Equifax credit report, identity theft insurance covering certain expenses related to the process of recovering from identity theft, and a Social Security number monitoring service that would scan suspicious websites for an individual’s Social Security number.

These services were offered to consumers from September 7, 2017, until January 31, 2018, when Equifax announced a new service called “Lock & Alert.” This new service allows consumers to use their smartphone or computer to lock and unlock their Equifax credit report. Equifax announced that it was making this service available to all consumers at no cost.

Federal Agencies Took a Variety of Actions in Response to the Equifax Breach

After Equifax announced the data breach, federal customer agencies took a variety of actions based on their responsibilities and how the breach affected their operations. Specifically, the agencies that were customers of the company’s services conducted independent assessments of the company’s security controls, revised their own identity proofing processes, and made changes to their contracts with Equifax, among other activities. Equifax did not ask the Department of Homeland Security (DHS), which is the central agency that responds to cyber incidents across the federal government, to assist in responding to the breach. Nevertheless, the department took the step of reminding federal agencies of the importance of correcting the software vulnerability that led to the breach. In addition, the oversight agencies, BCFP and FTC, began taking actions to investigate the breach and inform the public.

Major Federal Customers of Equifax Took Steps to Ensure Their Activities Were Not Adversely Affected by the Breach

IRS, SSA, and USPS—large agencies that were major customers of Equifax at the time of the breach—assessed the potential impact of the breach to their own operations as well as to the operations of their consumers. For example, these agencies assessed the technical impact of the breach on their own systems that rely on Equifax services to determine whether the breach could have compromised the integrity of their identity proofing processes. While there was no breach of agency systems or information, they also sought to determine which of their customers were directly affected by the breach, recognizing that those individuals could be at heightened risk of identity fraud. Information security officials we spoke to at IRS, SSA, USPS, and DHS expressed concern about how the breached data could be used to compromise sensitive information or fraudulently procure government services, even from agencies that are not direct customers of Equifax.

Representatives of IRS, SSA, and USPS noted that they responded to the breach independently of other agencies, because they said it was unclear whether any single federal agency had responsibility for coordinating government actions in response to a breach of this type in the private sector. According to the three agencies, their actions included the following: Identified affected individuals. Due to concerns about the potential for fraud using the stolen data, IRS and SSA both obtained from Equifax a list of the individuals affected by the Equifax breach. The agencies then used these lists to identify which of their own customers were affected and to look for potential instances of identity fraud affecting those customers.

Performed independent assessments of Equifax security controls. According to information security officials at IRS, SSA, and USPS, the agencies independently conducted site visits at Equifax’s data center in Alpharetta, Georgia, where they reviewed the company’s security controls. According to SSA officials, their agency’s review assessed compliance with the baseline set of controls required by the National Institute of Standards and Technology for systems determined to pose a moderate level of risk. SSA officials stated that they shared the results of their assessment with IRS, the Office of Management and Budget, House Ways and Means Social Security Subcommittee, and the Senate Committee on Finance. USPS officials said they reviewed both physical security and cybersecurity controls at Equifax’s data centers in Alpharetta, Georgia and St. Louis, Missouri locations. IRS officials said they also conducted a security assessment at Equifax’s Alpharetta data center, as well as a separate review of physical security and cybersecurity controls at the company’s St. Louis, Missouri site. The officials of all three agencies said that their reviews did not uncover any major new problems, but did identify a number of lower-level technical concerns that they required Equifax to address.

Modified contracts with Equifax. IRS and SSA made changes to contracts they had with Equifax to require prompt notification of any future breach, among other things. According to officials from both agencies, Equifax did not directly notify major federal customers of the 2017 breach prior to its public announcement because its contracts with these agencies required notification only of breaches directly involving the systems that provided services to the federal government. SSA officials stated that it was important to update the agency’s contract to require Equifax to promptly notify SSA of any data breach, regardless of which of the company’s systems it may affect. IRS officials stated that a similar change was made to their contract with Equifax for credit reporting services. The contract change also required the company to notify IRS within one hour after a breach is discovered, rather than within the previous time frame of 24 hours. In addition, according to the officials, cybersecurity language in the IRS’s contract was modified to ensure better implementation and oversight of technical security controls.

Communicated with the public and affected individuals. IRS made public announcements about the impact of the breach, noting that the agency did not expect the breach to have any impact on taxpayers’ ability to securely file tax returns. SSA issued a public blog post reminding consumers about steps they could take to protect their Social Security numbers.

Made changes to agency identity-proofing procedures. Following its assessment, IRS updated its internal cybersecurity contractor requirements and controls related to incident handling. Further, upon completing its assessment, USPS initiated discussions with the National Institute of Standards and Technology to determine risks associated with the knowledge-based verification questions it had been using with Equifax’s identity-proofing service. USPS subsequently changed its process, removing certain knowledge- based verification questions and adding a procedure whereby customers receive a code in the mail that they can use to verify their mailing addresses.

Canceled a short-term contract with Equifax. Before the Equifax breach, Equifax was the incumbent contractor at IRS for taxpayer identity and verification services. In June 2017, prior to the discovery of the breach, IRS began a new acquisition for these services by issuing a request for quotations to three CRA vendors (including Equifax and Experian) holding contracts under the federal supply schedule. IRS selected Experian as offering the lowest-priced, technically acceptable quotation, for issuance of a fixed-price task order and establishment of a blanket purchase agreement. Equifax filed a bid protest on July 5, 2017 with GAO challenging the IRS’s evaluation of Experian’s quotation. As described elsewhere in this report, Equifax discovered the breach on July 29 and, after investigating it, announced the breach on September 7. On September 29, during GAO’s consideration of the protest, IRS awarded Equifax a short-term, sole-source contract for $7.25 million to cover its need for the identity and verification services during the time frame needed to resolve the protest. IRS considered these services “critical” that “cannot lapse.” However, following the completion of its breach-related security assessments, IRS issued Equifax a stop-work order to suspend its performance under the short- term, sole-source order. GAO denied Equifax’s protest on October 16, 2017 and IRS proceeded with the task order issued to Experian for the taxpayer identity and verification services.

DHS Offered Breach Response Services to Equifax

In its role as the center for federal information security incident prevention and response, DHS offers services to assist federal agencies in preparing for potential cyber incidents, maintaining awareness of the current threat environment, and dealing with ongoing breaches. Under a Presidential directive, DHS is also responsible for assisting public- and private- sector critical infrastructure owners and operators in preparing for, preventing, protecting against, mitigating, responding to, and recovering from a cyber incident.

In September 2017, shortly after the Equifax breach was publicly announced, DHS contacted the company to offer its professional services related to forensic analysis and breach response. However, according to officials at both organizations, Equifax notified DHS officials that the company had already retained professional services from a private cybersecurity consultant and, thus, declined assistance from DHS.

Oversight Agencies Opened Investigations and Provided Information and General Advice to Consumers

According to Equifax officials, the company informed regulators about the data breach on September 7, 2017—when the general public was notified. FTC announced that it was investigating the Equifax breach, and Equifax stated in its annual report that several governmental agencies, including FTC and BCFP, were continuing to investigate events related to the breach.

BCFP staff told us that, immediately following notification of the breach, they participated in conference calls with Equifax to learn more about the breach. According to the officials, their calls with Equifax focused on ensuring consumers were provided with accurate information about the breach and what they could do to protect themselves. Equifax officials told us that they also informed FTC, the Securities and Exchange Commission, various states’ attorneys’ general, and the Financial Services Information Sharing and Analysis Center, that it had suffered a breach.

Shortly after Equifax’s public announcement of the breach, BCFP released a blog post on the top 10 ways that consumers could protect themselves in the wake of the breach. Suggestions included regularly reviewing credit reports, checking credit card statements, and changing passwords for all financial accounts. In addition, BCFP posted on its website actions consumers could take to protect themselves against fraud or identity theft, including freezing credit and placing fraud alerts.

BCFP staff told us that, while the agency posts information to its website, it does not provide individual legal assistance to consumers. Nevertheless, the staff said that consumers can file a complaint with BCFP if they are experiencing issues related to a CRA. BCFP staff added that they received a large volume of consumer complaints following the Equifax breach. BCFP staff said they use such complaints as one factor to prioritize future supervisory examinations, as well as investigations and enforcement actions.

In October 2017, BCFP also began conducting targeted data security and cybersecurity examinations. Specifically, in addition to assessing whether the CRAs’ data security practices and policies constitute violations of federal consumer financial law, BCFP began assessing risks to consumers posed by potential cybersecurity lapses and to markets for consumer financial products and services. BCFP staff said that whether BCFP continues to conduct CRA cybersecurity examinations will depend on whether they identify the issue as a priority through future examination prioritization processes.

Similarly, FTC released a statement to consumers with information about the breach, such as when it occurred and the types of data compromised. The statement also included guidance on steps consumers could take to help protect their information from being misused. For example, FTC encouraged individuals to visit Equifax’s website to find out whether their information may have been exposed, provided links to obtain a free credit report, and offered other information about credit freezes and fraud alerts.

On June 25, 2018, eight state banking regulators issued a consent order requiring Equifax to address various data security issues. The order included several areas of concern, including general information security, internal audits, and board and management oversight. More specifically, the order required Equifax, the board, or its audit committee to, among other things: provide a written risk assessment that identifies foreseeable threats and vulnerabilities to the confidentiality of PII; establish a formal and documented internal audit program that is capable of effectively evaluating information technology controls; improve the oversight of its information security program; improve oversight and documentation of its critical vendors; improve standards and controls for supporting the patch management function; and enhance oversight of IT operations as it relates to disaster recovery and business continuity functions.

Under the consent order, Equifax was required to submit a list of all remediation projects planned, in process, or implemented to the state regulatory agencies by July 31, 2018.

Agency Comments and Third-Party Views

We provided a draft of this report to BCFP, DHS, FTC, IRS, SSA, USPS, and Equifax for comment. SSA and USPS provided written responses expressing appreciation for the opportunity to review the draft report. The SSA and USPS responses are reprinted in appendices II and III, respectively. In addition, BCFP, DHS, FTC, IRS, SSA, USPS, and Equifax provided technical comments orally and via email, which we have incorporated, as appropriate.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 29 days from the report date. At that time, we will send copies to the appropriate congressional committees, Equifax, and to the Acting Director of the Bureau of Consumer Financial Protection; the Chairman of the Federal Trade Commission; the Secretary of the Department of Homeland Security; the Commissioners of the Internal Revenue Service and Social Security Administration; and the Postmaster General of the United States. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.We are sending copies of this report to In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact Nick Marinos at (202) 512-9342 or marinosn@gao.gov, or Michael Clements at (202) 512-8678 or clementsm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) summarize the events regarding the 2017 Equifax breach and the steps taken by the company to assess, respond to, and recover from the incident and (2) describe the actions that federal customers and oversight agencies took in response to the breach.

To address the first objective, we obtained and assessed documentation generated in response to the breach. Specifically, we analyzed the results of security assessments conducted by Equifax and its cybersecurity consultant following the breach, which included information about how the attacker gained access to Equifax’s systems and the specific vulnerabilities that were exploited. This documentation included the report summarizing the results of the consultant’s forensic analysis of Equifax systems and the consultant’s recommendations to Equifax to address the factors that led to the breach. We also reviewed Equifax’s relevant public filings to the Securities and Exchange Commission and statements it provided to the public and shareholders, which included information about the data breach and the company’s efforts for remediation.

Further, we conducted a site visit to the Equifax data center in Alpharetta, Georgia, to interview knowledgeable officials, such as the interim Chief Security Officer and other officials knowledgeable about how Equifax stores and processes data, and observed physical security measures. In addition, to clarify details of the breach and the steps that Equifax took, we interviewed officials at Equifax who were responsible for coordinating reviews conducted following the breach. Specifically, we interviewed the interim Chief Security Officer and government relations employees, who were responsible for coordinating Equifax’s interaction with federal agencies in response to the incident.

We did not independently assess Equifax’s information security controls or the steps the company took to address identified factors that contributed to the ineffective implementation of those controls. Specifically, the scope of our report was to report on actions taken by Equifax and agencies in response to the breach. Consequently, the information in this report is based on public filings and announcements as well as information provided to us by the company. We did not reach conclusions regarding the adequacy or efficacy of Equifax’s security measures.

To address the second objective, we selected three major federal agencies, Internal Revenue Service (IRS), Social Security Administration (SSA), and United States Postal Service (USPS), which were Equifax’s largest federal customers at the time of the breach. We initially identified these customer agencies by reviewing public reports following the breach that identified federal agencies that were major Equifax customers at the time. We also interviewed Equifax officials responsible for managing government accounts to confirm that these three agencies were the only large-scale federal customer agencies that interacted with Equifax following the breach. Other federal agencies also have contracts with Equifax for a variety of services; we did not conduct audit work for this engagement at any other agencies because we narrowed our selection criteria to the largest federal agencies that used Equifax’s services to conduct their identity-proofing processes.

Subsequently, we analyzed documentation from IRS, SSA, and USPS to describe the relevant actions these agencies took in response to the breach, as well as documentation regarding oversight by BCFP and FTC, which are the federal agencies with primary oversight responsibilities over CRAs. Specifically, we reviewed relevant laws and BCFP guidance on data security examinations. In addition, we spoke with BCFP and FTC officials about their actions in response to the data breach and reviewed their websites for information provided to consumers.

We also selected and reviewed contracts between Equifax and each of the three selected agencies—IRS, SSA, and USPS—to determine what changes were made to services, such as identity-proofing solutions, provided by Equifax to federal agencies as a result of the breach. The contracts we reviewed were the ones identified by IRS, SSA, and USPS as contracts with Equifax for credit reporting or identity-proofing services.

Further, we conducted interviews with agency officials at BCFP, FTC, DHS, IRS, SSA, and USPS to determine what actions customer and oversight agencies took in response to the breach. The officials we interviewed were responsible for conducting their agencies’ security assessment of Equifax at the time of the data breach. These included officials at each agency that had a role in responding to the Equifax breach, such as investigators at the oversight agencies and information security officials at the federal customer agencies.

To address both objectives, and to identify how federal requirements apply to credit reporting agencies, we analyzed relevant federal laws to determine the responsibilities of agencies and their contractors. Specifically, we reviewed the following laws:

Dodd-Frank Wall Street Reform and Consumer Protection Act;

Fair Credit Reporting Act;

Privacy Act of 1974; and

E-Government Act of 2002.

We conducted this performance audit from November 2017 to August 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Social Security Administration

Appendix III: Comments from the United States Postal Service

Appendix IV: GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

In addition to the individuals named above, John de Ferrari and John Forrester (assistant directors); Tina Torabi (analyst-in-charge); Bethany Benitez, Chris Businsky, Kavita Daitnarayan, Nancy Glover, Andrea Harvey, Thomas Johnson, David Plocher, Tovah Rom, Rachel Siegel, and Winnie Tsen made key contributions to this report.