Equifax Data Breach: A Case Study in GRC and Risk Management
What Happened at Equifax in 2017
This GRC risk management case study examines the 2017 Equifax data breach and the gaps in vulnerability management, IT asset tracking and internal accountability that contributed to the incident. It also shows how enterprise risk management practices can help organizations identify security risks, assess their business impact and track corrective actions.
Organization
Equifax, a major US credit reporting agency holding names, Social Security numbers, birth dates and addresses.
Problem
A critical flaw (CVE-2017-5638) in Apache Struts let attackers run commands on a vulnerable server through a specially crafted web request. A fix was released on March 7, 2017, but it was not applied to the internet-facing consumer dispute portal.
Breach
Attackers entered in mid-May and took data until the intrusion was found on July 29. The breach was announced on September 7.
147 million people
Impact: about 147 million people were affected. A 2019 settlement with US regulators and states was worth up to about $700 million, and senior leaders left the company.
Timeline of the incident (2017)
Which Risk Category Does It Fall Under?
Risk identification is an important part of enterprise risk management. It means listing what could harm the business and placing each risk in a category, so that it gets an owner and the right controls. The main risk here was an unpatched critical vulnerability on an internet-facing system holding customer data.
Where identification comes from
Vendor and government alerts, vulnerability scans, the asset inventory, audits and past incidents.
What went wrong
The system was not recognized as a critical internet-facing asset, the asset inventory was incomplete, and the scan missed it.
Basis and Calculation
An enterprise risk management framework allows organizations to assess identified risks using consistent likelihood and impact criteria. Assessment gives each risk a score so risks can be compared and prioritized. The method is a 5x5 matrix.
Risk score = Likelihood (1 to 5) × Impact (1 to 5)
Rating scale and expected action
Worked calculation for Equifax
How a GRC Program Closes Each Gap
A GRC platform such as Corporater GRC Software can support this process by maintaining risk registers, assigning responsibility for identified risks, tracking control implementation and reporting overdue remediation activities. For an incident such as Equifax, these capabilities help management monitor vulnerabilities and ensure that critical issues receive the required attention. Each failure in the case maps to a specific fix in a GRC risk program.
Key Risk Indicators (KRIs) to monitor
A GRC programme should track a set of measurable indicators to identify control failures before they lead to serious incidents.
100%
Critical patches applied within the required deadline.
Zero
Internet-facing assets missing from the IT inventory.
Security tool health
Track and escalate every occurrence of an expired certificate or failed health check on security tools.
Zero
Risk exceptions past their review date.
Conclusion
The Equifax breach demonstrates how weaknesses in vulnerability management, asset tracking and internal accountability can expose an organisation to serious financial, legal and reputational consequences.
This GRC risk management case study highlights the importance of identifying risks, assigning clear ownership, setting treatment deadlines and verifying that security controls are working.
An effective enterprise risk management programme, supported by a GRC platform such as Corporater, can give management a structured way to maintain risk records, monitor corrective actions and report unresolved issues to senior leadership.
Are Your Critical Risks Owned, Tracked and Escalated?
Need Help with GRC and Risk Management?
Schedule a consultation to discuss your current risk process and see how a GRC platform can support your business.
Schedule a Consultation
Xponential Digital