The massive data breach in Equifax that was dicslosed on september 7th has resulted in immediate retirement of the Chief Security Officer Susan Mauldin and Chief Information Officer David Webb
Russ Ayres, who previously served as a Vice President in the Equifax IT department, has been appointed interim Chief Security Officer. Mark Rohrwasser has been appointed interim Chief Information Officer.
Equifax informed customers earlier this month that hackers had access tpo its system between mid-May and late July. The breach, which affects roughly 143 million U.S. consumers, involved names, social security numbers, dates of birth, addresses and, in some cases, driver’s license numbers.
The company has hired FireEye-owned breach investigations firm Mandiant to work on the investigations, and noted that “Equifax’s internal investigation of this incident is still ongoing and the company continues to work closely with the FBI in its investigation.”
Equifax initially only revealed that the cybercriminals exploited a vulnerability in a “U.S. website application” to access files. However, financial services firm Baird later claimed to have learned that the application in question was Apache Struts, a framework used by many top organizations to create web apps.
Security blogger Brian Krebs reported on Tuesday that an Equifax Argentina employee portal exposed 14,000 records including employee credentials and consumer complaints.
After New York Attorney General Eric T. Schneiderman announced the launch of a formal investigation into the Equifax breach, Illinois and nearly 40 other states joined the investigation.
Equifax shares have fallen more than 30% since the disclosure of the breach, wiping more than $5 billion off the company’s market capitalization.
Equifax says that it maintains data on more than 820 million consumers and more than 91 million businesses worldwide.
It was also reported that scammers are already offering sale of the stolen data. Shortly after Equifax disclosed the breach, various individuals started claiming to possess the stolen data. One hacker with the online moniker “1x0123,” who had previously been credited for finding vulnerabilities in software and websites, offered to sell access to Equifax servers on Twitter, but later locked his account after more reputable researchers pointed out that he was a scammer.
One of the first scam scam websites emerged on the Tor anonymity network hours after Equifax made the announcement. The individuals who had set up the site wanted Equifax to pay them 600 bitcoin (at the time worth roughly $2.7 million) to prevent the public release of all the data – except the credit card numbers – on September 15.
After several experts pointed out that it was a scam, the operator of the service hosting the Tor website shut them down.
A more recent attempt to allegedly sell the Equifax data comes from a group calling itself “Equihax.” They offered to release all the data via a crowdfunding effort whose goal was 600 bitcoin or 8,400 Ethereum. They also offered to sell 1 million data entries for 4 bitcoin ($12,500).
In order to prove that they are in possession of the Equifax data, they leaked the records of three individuals – Donald Trump, Kim Kardashian and Bill Gates – and posted various screenshots apparently showing that they had access to the credit reporting agency’s systems.