Photo: AP
Equifax, the credit reporting agency which recently lost said credit information on up to 143 million people to hackers, experienced another security breach months before it has already disclosed—and this news broke on the same day it was reported senior Equifax executives are being investigated for selling off stock after the attack.
Per Bloomberg, three people familiar with the situation have said intruders successfully launched a “major breach” in March. That is months before the previously known breach, which Equifax says began in May and it learned of in late July. At least one of the three people who spoke to the news agency said the same hackers were behind both breaches, though the company says they were unrelated incidents.
Equifax hired security firm Mandiant after the March breach, which conducted a multi-month investigation, “only to have to bring the investigators back when it detected suspicious activity again on July 29,” Bloomberg reported.
“The retention of Mandiant in March was unrelated to the July 29 cybersecurity incident,” an Equifax spokesperson told Gizmodo in a statement. “Equifax complied fully with all consumer notification requirements related to the March incident. The two events are not related.”
The later breach exploited a vulnerability in open-source server framework software Apache Struts which Equifax failed to fix for months after a patch was available.
Meanwhile, investment news site ThinkAdvisor wrote people familiar with the matter say the US Department of Justice has launched an investigation into whether three top Equifax executives broke the law by selling off over a million dollars in stock after the company learned of the hack.
Investigators are looking into whether Equifax chief financial officer John Gamble, president of U.S. information solutions Joseph Loughran and president of workforce solutions Rodolfo Ploder knew of the breach when they sold off over $1.8 million in stock. The sales were not pre-scheduled, and anyone in the loop on the hack would have known Equifax stock was about to take a serious hit—though the company says the managers were not informed of the breach prior to the sales.
Equifax recently said two senior executives, Chief Information Officer David Webb and Chief Security Officer Susan Mauldin, were already “retiring.”
According to ThinkAdvisor, Atlanta prosecutors, the FBI and the Securities and Exchange Commission are all involved in the multiple federal probes into the hacks and the suspicious sales. The Federal Trade Commission has publicly confirmed its own inquiry, saying it usually does not comment on ongoing investigations but wanted to make it known “in light of the intense public interest and the potential impact of this matter.”
[Bloomberg, ThinkAdvisor]