The Equifax breach that exposed sensitive data for as many as 143 million US consumers was accomplished by exploiting a Web application vulnerability that had been patched more than two months earlier, officials with the credit reporting service said Thursday. 
 
 "Equifax has been intensely investigating the scope of the intrusion with the assistance of a leading, independent cybersecurity firm to determine what information was accessed and who has been impacted," company officials wrote in an update posted online . "We know that criminals exploited a US website application vulnerability. The vulnerability was Apache Struts CVE-2017-5638. We continue to work with law enforcement as part of our criminal investigation, and have shared indicators of compromise with law enforcement." 
 
 The flaw in the Apache Struts framework was fixed on March 6. Three days later, the bug was already under mass attack by hackers who were exploiting the flaw to install rogue applications on Web servers. Five days after that, the exploits showed few signs of letting up . Equifax has said the breach on its site occurred in mid-May, more than two months after the flaw came to light and a patch was available. 
 
 Thursday's disclosure strongly suggests that Equifax failed to update its Web applications, despite demonstrable proof that the bug gave real-world attackers an easy way to take control of sensitive sites. An Equifax representative didn't immediately respond to an e-mail seeking comment on this possibility. 
 
 As Ars warned in March, patching the security hole was labor intensive and difficult, in part because it involved downloading an updated version of Struts and then using it to rebuild all apps that used older, buggy Struts versions. Some websites may depend on dozens or even hundreds of such apps, which may be scattered across dozens of servers on multiple continents. Once rebuilt, the apps must be extensively tested before going into production to ensure they don't break key functions on the site. 
 
 Equifax's update confirms a report published last week by a firm called Baird Equity Research. It provided no source for the claim that Equifax was breached through an unidentified Apache Struts vulnerability. Two days later, the Apache Software Foundation issued a statement saying it didn't know one way or the other if a Struts vulnerability was involved. CVE-2017-5638 is separate from CVE-2017-9805, an Apache Struts vulnerability that was patched last week. 
 
 Apache Struts is a framework for developing Java-based apps that run both front-end and back-end Web servers. It is relied on heavily by banks, government agencies, large Internet companies, and Fortune 500 companies. Experian, one of the three big credit reporting services, and annualcreditreport.com, which provides free credit reports, both reportedly rely on Apache Struts as well. 
 
 Up to now, Equifax has said only that criminals exploited an unspecified application vulnerability on its US site to gain access to certain files. Now, we know that the flaw was in Apache Struts and had been fixed months before the breach occurred. ||||| Capping a week of incompetence, failures, and general shady behavior in responding to its massive data breach, Equifax has confirmed that attackers entered its system in mid-May through a web-application vulnerability that had a patch available in March. In other words, the credit-reporting giant had more than two months to take precautions that would have defended the personal data of 143 million people from being exposed. It didn't. 
 
 As the security community processes the news and scrutinizes Equifax's cybersecurity posture, numerous doubts have surfaced about the organization's competence as a data steward. The company took six weeks to notify the public after finding out about the breach. Even then, the site that Equifax set up in response to address questions and offer free credit monitoring was itself riddled with vulnerabilities. And as security journalist Brian Krebs first reported, a web portal for handling credit-report disputes from customers in Argentina used the embarrassingly inadequate credentials of "admin/admin." Equifax took the platform down on Tuesday. But observers say the ongoing discoveries increasingly paint a picture of negligence—especially in Equifax's failure to protect itself against a known flaw with a ready fix. 
 
 A 'Relatively Easy' Hack 
 
 The vulnerability that attackers exploited to access Equifax's system was in the Apache Struts web-application software, a widely used enterprise platform. The Apache Software Foundation said in a statement on Saturday (when rumors swirled that the March Struts bug might be to blame) that, though it was sorry if attackers exploited a bug in its software to breach Equifax, it always recommends that users regularly patch and update their Apache Struts platforms. "Most breaches we become aware of are caused by failure to update software components that are known to be vulnerable for months or even years," René Gielen, the vice president of Apache Struts, wrote. 
 
 In this case, Equifax had ample opportunity to update. 
 
 "This vulnerability was disclosed back in March. There were clear and simple instructions of how to remedy the situation. The responsibility is then on companies to have procedures in place to follow such advice promptly," says Bas van Schaik, a product manager and researcher at Semmle, an analytics security firm. "The fact that Equifax was subsequently attacked in May means that Equifax did not follow that advice. Had they done so this breach would not have occurred." 
 
 Penetration testers and other security researchers say that it would have been simple for an attacker to exploit the flaw and get into the system. "Once they identified Equifax's systems as vulnerable, actually exploiting the vulnerability to gain access to the Equifax servers and network will unfortunately have been relatively easy," says van Schaik, who recently discovered and disclosed a different Apache Struts bug. "It's hard to say how difficult it will have been for the attackers to get their hands on customer data once they found their way into Equifax's servers and network. But the timeline suggests that time was on the attackers' side." 
 
 After exploiting the vulnerability to gain a foothold, the attackers may have found scores of unprotected data immediately or may have worked over time—between mid-May and the end of July—to gain more and more access to Equifax's systems. "Generally when you successfully exploit a web-application bug like this you will become the system user who owns the web server process," says Alex McGeorge, the head of threat intelligence at the security firm Immunity. "Security best practices dictate that this user have as little privilege as possible on the server itself, since security vulnerabilities in web applications and web servers are so commonly exploited." In practice, though, McGeorge says that hackers could have found credentials or other information in plaintext right away if Equifax didn't have proper protections in place. 
 
 Mounting Concerns 
 
 The company's attempts at damage control have been boilerplate at best. "Equifax has been intensely investigating the scope of the intrusion with the assistance of a leading, independent cybersecurity firm to determine what information was accessed and who has been impacted," the company said in a statement Wednesday. "We continue to work with law enforcement as part of our criminal investigation." 
 
 Lawmakers are planning two hearings to scrutinize the situation, though, and have requested detailed information about the breach from Equifax. Dozens of people whose personal data was exposed have already filed lawsuits against the company. Peter Kaplan, the acting director of public affairs at the Federal Trade Commission, told WIRED in a statement that "the FTC typically does not comment on ongoing investigations. However, in light of the intense public interest and the potential impact of this matter, I can confirm that FTC staff is investigating the Equifax data breach." And politicians have additionally called on federal watchdog and protection agencies like the Securities and Exchange Commission and the Consumer Financial Protection Bureau to initiate their own investigations. 
 
 Equifax will suffer scrutiny and losses because of the breach, but the real victims are the individuals whose data was potentially compromised. And Equifax has particular responsibility to protect its consumer data, since much of it doesn't even come from customers who directly choose to do business with the firm, but surfaces instead from credit check requests for anyone living and working in the US. "I am concerned," Immunity's McGeorge says. "This is a thing that you use whether you realize it or not, because all commerce data goes through them. You do have a stake in this."
– Remember that massive Equifax data breach that exposed the names, security numbers, and more of 143 million US consumers? It now appears Equifax had "clear and simple instructions" on how to avoid it and more than two months to follow them. The credit reporting company announced Thursday that hackers exploited a vulnerability in the Apache Struts web application between May and July, Ars Technica reports. But here's the thing: A patch to fix that particular vulnerability had been available for more than two months by that point. "This vulnerability was disclosed back in March," a researcher at an analytics security firm tells Wired. "There were clear and simple instructions of how to remedy the situation." Not only was a patch available to Equifax, but there were public reports back in March of hackers exploiting websites that hadn't yet fixed the Apache Struts vulnerability. The New York Times reports it's unclear why Equifax didn't patch the vulnerability. "Most breaches we become aware of are caused by failure to update software components that are known to be vulnerable for months or even years," Wired quotes the vice president of Apache Struts as saying. Experts say it would have been fairly easy for hackers to exploit the vulnerability with Equifax having not patched it.