The Top Takeaways From The Equifax Hack

  9/18/17    Posted in News

Over 143 million Americans have been affected by a cyber attack at Equifax, a consumer credit reporting agency. Experts say it may never be possible to calculate the exact number of people affected by these cyber thieves.

Equifax cyber criminals managed to steal social security numbers, names, addresses and drivers licenses, data dubbed as the crown jewels of identification. Ensure that your organization networks, computers, programs and data are protected from a cyber attack, damage or unauthorized access with the help of the experts at VALiNTRY.

Identifying the Cause of the Cyber Attack

Headquartered in Atlanta, Georgia, Equifax is one of the nation’s three largest credit bureaus. The company collects and aggregates the information of consumers and businesses across the globe. Employing over 9,000 employees and boasting over 3 billion dollars in revenue, how did such a corporate giant fall victim to a cyber attack?

In March 2017, a massive server bug was identified which now months later, provided a means for hackers to attack. Most organizations would understand the magnitude of these issues and immediately begin installing patches and securing their servers. The compromise in March stemmed from Equifax failing to install security updates when necessary. This vulnerability provided cyber attackers 24 hours to exploit the flaw while taking control of webservers, downloading data and installing malware.

Equifax utilized Apache Struts, created by the Apache Foundation, a popular server software that many large companies utilize including Fortune 100 organizations such as Lockheed Martin, Citigroup, Vodafone, Virgin Atlantic, Reader’s Digest and the IRS. Apache struts use as a framework which allows developers to easily build custom websites. However, its all-in-one approach can also be a weakness.

 

Ron Winward, a security researcher for Radware states,

“The software touches all aspects of a company’s website, once you break in through one window you can get in to the rest of the house — and the rest of the houses in the neighborhood.”

 

The problem for Equifax, is that the flaws in STRUTS has been widely documented. Although the Apache Foundation has been proactive in deploying fixes that patching the vulnerability, Equifax did not patch the identified flaws to the best of its ability.

Although Equifax CEO Richard F. Smith has said, “we will make changes,” and has offered affected consumers a year of free credit monitoring and waived credit freeze fees for the next 30 days, businesses and consumers may be weary to use their services again.

What can happen when this information gets into the hands of cyber criminals? Cyber criminals can open bank accounts, lines of credit, new credit cards and drivers’ licenses in your name and recovering from identity theft could take months or even years.

 

What Happens To Identity Fraud Victims

When most identity fraud occurs, victims are left wondering, do they have to pay back any expenses incurred from the thieves? When the identity theft involves a debit or credit card, losses are limited under the Fair Credit Billing Act and the Electronic Fund Transfer Act.

 

The Fair Credit Billing Act caps liability for unauthorized credit card purchases at $50 while for stolen ATM and debit cards, liability depends on how quickly a person reports the loss or theft.

 

In the case that your identity has been stolen, immediately take these 5 steps:

  1. Put fraud alert on your credit reports: A fraud alert puts a red flag on your credit report and notifies lenders and creditors that they should take extra steps to verify your identity before extending credit. Another option and an effective identity theft prevention measure, is to place a security freeze on each of your credit reports. A freeze prevents creditors from accessing your credit reports.
  2. Contact affected institutions directly: If your ATM card was stolen, contact the bank directly. In the case of a credit card being stolen, report the theft to the issuer of the credit card.
  3. Contact the Federal Trade Commission (FTC): By filing a police report and an Identity Theft Affidavit, the FTC will help you understand and identify what type of fraud was committed and what to do next.
  4. Protect your social security number: In the event that your social security number was stolen, contact Social Security Administration (SSA) and the Internal Revenue Service (IRS), even if you don’t yet see any evidence of financial fraud.
  5. Contact the Post Office: If you have reason to believe the identity thief may have submitted a fraudulent change-of-address to the post office or has used the U.S. mail to commit the fraud against you, contact the Postal Inspection Office.

 

Avivah Litan, a fraud analyst states, “Cyberwar is in large part conducted through data mining and cyber intelligence. This is also a Homeland Security risk as enemy nation states build databases of Americans that they then use to get to their targets, for example a network operator at a power grid, or a defense contractor at a missile defense company.”

 

If you own a small to mid sized business, don’t think that your organization is immune to cyber attacks.

According to Symantec, over 43% of cyber attacks target small businesses.

 

Experts believe this is because most larger companies are constantly updating their security and smaller business are seen as an easier target to cyber criminals because they have less resources to put in high end cyber security protection. In a recent survey conducted by CNBC, only 2% of small businesses said they viewed a cyberattack as the most critical issue that they face. Why should these organizations care?

 

60 percent of these smaller companies will go out of business within 6 months of a cyber attack.

Protecting Your Business with Cyber Security

Cyber attack strategies are getting more sophisticated on a daily basis, however there are some effective ways to help protect your business:

  • Get cyber security insurance: Cyber liability insurance protects your business from various cyber security threats. If your company is held liable due to a breach occuring, this insurance will help in the case of a lawsuit.
  • Create a password strategy: Road names, pets, most employees utilize simple passwords, leaving your organization vulnerable to cyber hackers.  Employees should be required to create passwords that include a combination of uppercase and lowercase letters, along with numbers and symbols while resetting their passwords at least once a month.
  • Utilize virtual data rooms (VDR): These rooms allow for employees to safely and easily share data. From tax paper work to financial information and legal documentation, VDR’s help keep sensitive information safe.
  • Identify internal threats: Most cyber security issues that occur are a result of someone inside of your company. Be aware of what sensitive information is accessible.

 

Protect your business by starting with a technology audit from the experts at VALiNTRY. Our team will examine your security practices and network to identify vulnerabilities. Our security expert consultant Xavier Harris is a CISSP, with experience managing both local and global initiatives. His expertise is in creating and implementing IT architecture that ensure cyber security. From enterprise risk and compliance to incident management and penetration testing, our team will help your business mitigate risk factors.