Equifax: a vulnerable portal led into unrelated databases

What was reported

The FTC’s account of its Equifax case describes attackers exploiting unpatched software in 2017 and reaching unrelated databases. It also describes plaintext administrative credentials that enabled further access. Approximately 147 million names and dates of birth were stolen, alongside other sensitive information.

Read the report from Federal Trade Commission

Our perspective

Our reading: A boundary matters most after something goes wrong. Separating what a tool can reach limits the permissions it carries into other work; it should not inherit every connected system’s authority.

Limits of this connection

The initial failure required software patching and infrastructure controls. This case does not establish that Vivendur could have prevented the compromise or its full consequences.