{"id":45486,"date":"2017-10-03T06:04:34","date_gmt":"2017-10-03T06:04:34","guid":{"rendered":"https:\/\/www.biphoo.com\/bipnews\/?p=45486"},"modified":"2017-10-03T06:04:34","modified_gmt":"2017-10-03T06:04:34","slug":"equifax-failed-to-patch-security-vulnerability-in-march","status":"publish","type":"post","link":"https:\/\/www.biphoo.com\/bipnews\/business\/equifax-failed-to-patch-security-vulnerability-in-march.html","title":{"rendered":"Equifax failed to patch security vulnerability in March"},"content":{"rendered":"

Equifax failed to patch security vulnerability in March<\/span><\/strong><\/span><\/h2>\n

Equifax failed to patch security vulnerability in March: Equifax Inc (EFX.N) was alerted in March to the software security vulnerability that led to hackers obtaining personal information of more than 140 million Americans but took months to patch it, its former CEO said in testimony to be delivered to Congress on Tuesday.<\/span><\/p>\n

\u201cIt appears that the breach occurred because of both human error and technology failures,\u201d former CEO Richard Smith said in written testimony released on Monday by the Energy and Commerce Committee.<\/span><\/p>\n

Separately, Equifax said late Monday that an outside review determined about 2.5 million additional U.S. consumers were potentially impacted, for a revised total of 145.5 million.<\/span><\/p>\n

The company said the review also found that just 8,000 Canadian citizens were impacted, rather than up to 100,000 Canadians, as previously announced.<\/span><\/p>\n

Equifax was alerted to the breach by the U.S. Homeland Security Department on March 9, Smith said in the testimony, but it was not patched.<\/span><\/p>\n

On March 15, Equifax\u2019s information security department ran scans that should have identified any systems that were vulnerable to the software issue but did not, the testimony said.<\/span><\/p>\n

As a result, \u201cthe vulnerability remained in an Equifax web application much longer than it should have,\u201d Smith said. \u201cIt was this unpatched vulnerability that allowed hackers to access personal identifying information.\u201d<\/span><\/p>\n

In his testimony, Smith said it appears the first date hackers accessed sensitive information may have been on May 13. He said \u201cbetween May 13 and July 30, there is evidence to suggest that the attacker(s) continued to access sensitive information.\u201d<\/span><\/p>\n

Smith said security personnel noticed suspicious activity on July 29 and disabled the web application on July 30, ending the hacking. He said he was alerted the following day, but was not aware of the scope of the stolen data.<\/span><\/p>\n

On Aug. 2, the company alerted the FBI and retained a law firm and consulting firm to provide advice. Smith notified the board\u2019s lead director on Aug. 22.<\/span><\/p>\n

Smith, 57, said he was retiring last week and would forgo this year\u2019s bonus as criticism mounts over the attack, which was not made public until Sept. 7 and has prompted investigations by multiple federal and state agencies, including a criminal probe by the U.S. Justice Department.<\/span><\/p>\n

\u201cI am here today to apologize to the American people myself,\u201d he said.<\/span><\/p>\n

Smith also apologized for the company\u2019s response after the data breach was made public, including the \u201crollout of our website and call centers, which in many cases added to the frustration of American consumers.\u201d<\/span><\/p>\n

He also said another well-known, independent expert consulting firm \u201chas been retained to perform a top-to-bottom assessment of the company\u2019s information security systems.\u201d<\/span><\/p>\n

Smith will testify at three separate congressional hearings this week.<\/span><\/p>\n

Source:http:\/\/www.reuters.com\/article\/us-equifax-breach\/equifax-failed-to-patch-security-vulnerability-in-march-former-ceo-idUSKCN1C71VY<\/span><\/p>\n

\n\t\t\t
\n\t\t\t <\/div><\/div>\n\t\t