The unsettling part is how ordinary the entry point was. A security flaw in widely used web software had been publicly disclosed in March 2017, and a fix was available. It still hadn’t been applied to one of Equifax’s systems. The attackers were inside the network for 76 days before anyone noticed.

How does a stranger on the internet go from one unpatched system to holding the records of nearly half a country? Let’s walk through it, one stage at a time.

The big picture: a breach is a chain, not a single event

When we hear “data breach,” it sounds like one dramatic moment. In reality it’s a chain of stages, and the attacker has to succeed at every one of them. Break any link and the attack fails.

Think of it like a burglary. Nobody walks into a building and leaves with the safe in one step. They case the place, find a way in, get access to the right rooms, find the valuables, carry them out, and cover their tracks. A cyberattack follows the same pattern, so I’ll use this analogy throughout.

The stages

1. Reconnaissance: casing the building

Before attacking, the attacker researches the target: which software it runs, which systems face the internet, and who works there. Much of this is automated. Attackers scan the internet for systems running software with known flaws.

Equifax: Within days of the Apache Struts flaw going public, attackers were already probing for systems that hadn’t been patched.

2. Initial access: getting through a door

This is the first way in. Common doors are phishing emails, stolen or reused passwords, and unpatched software.

Equifax: The door was an unpatched web application, the online dispute portal. The fix had been public for about two months.

3. Foothold and privilege escalation: getting more keys

Once inside, the attacker plants a way back in and looks for higher-level access. A regular account isn’t very useful, but credentials that open many systems are gold.

Equifax: The attackers found usernames and passwords stored unencrypted in a data repository. Those credentials opened up dozens of other databases, well beyond the dispute portal.

4. Lateral movement: walking through the building

The attacker moves from system to system, looking for where the valuable data lives. This stage is quiet and can take days or weeks.

Equifax: They ran roughly 9,000 queries across 51 databases, searching for sensitive records. They blended in with normal network activity, which is part of why nobody noticed.

5. Exfiltration: loading the van

The data is collected and sent out of the network, often prepared first so it’s easier to move and harder to spot.

Equifax: The attackers stored the stolen data in temporary files, compressed and split them into pieces, and sent them out of the network. A security tool that should have inspected that outbound traffic wasn’t doing its job, because its certificate had expired.

6. Covering tracks and impact: wiping fingerprints

The attacker hides evidence, and then the stolen data is sold, used for fraud, or used for extortion. For the victims, this is when the real damage begins.

Equifax: The fallout was huge. In 2019, Equifax agreed to a settlement of at least $575 million, and potentially up to $700 million, with US regulators and states. In 2020, the US Department of Justice charged four members of China’s military over the attack.

Why breaches go unnoticed

The gap between an attacker getting in and anyone noticing is called dwell time. At Equifax the attack ran for 76 days. Many organizations focus on keeping attackers out and forget that detection matters just as much, because every extra day inside gives the attacker more time to find and take data.

How this maps to professional frameworks

If you want a career in security, you’ll see this attack chain again and again. Professionals describe it with two well-known frameworks.

MITRE ATT&CK is a public catalog of how real attackers behave, organized into tactics. Equifax lines up like this:

• Reconnaissance: scanning for systems running the vulnerable software

• Initial Access: exploiting the dispute portal

• Credential Access and Privilege Escalation: finding the unencrypted passwords

• Lateral Movement: moving across the 51 databases

• Collection and Exfiltration: staging, compressing and sending out the data

The Lockheed Martin Cyber Kill Chain is an older, simpler model with seven phases: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. It’s a good way to think about how an attack unfolds in order.

Why does this matter? Analysts and GRC teams use these frameworks as a shared language. They map an incident to the framework, spot which stage had no defense, and choose controls to fill the gap.

Where defenders break the chain

• Reconnaissance: reduce what’s exposed to the internet, and know what software you run.

• Initial access: patch fast, use MFA, and train staff to spot phishing.

• Foothold and escalation: apply least privilege, and never store passwords unencrypted. This is the exact Equifax failure.

• Lateral movement: segment the network so one compromised system can’t reach everything.

• Exfiltration: run monitoring and data loss prevention (DLP), and check that those tools actually work, including their certificates.

  Notice the lesson from Equifax: no exotic attack was needed. Basic patching, segmentation and monitoring, done consistently, would have broken the chain early.

What you can do

1. Use a password manager and turn on MFA for your important accounts.

2. Keep your devices and apps updated. Patching is the most boring and most effective defense.

3. Back up your data somewhere separate from your main device.

Check yourself

1. At which stage would MFA help the most, and why?

2. Why is lateral movement so hard to spot?

3. What was the real failure at Equifax: the attacker’s skill, or the defender’s process?

Sources

• US House Committee on Oversight and Government Reform, The Equifax Data Breach (December 2018): https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf

• US Government Accountability Office, GAO-18-559: https://www.gao.gov/products/GAO-18-559

• FTC, Equifax Data Breach Settlement: https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement

• NIST National Vulnerability Database, CVE-2017-5638: https://nvd.nist.gov/vuln/detail/CVE-2017-5638

• MITRE ATT&CK: https://attack.mitre.org

What’s next

This is the first post in the Cybersecurity Foundations series. Next up: how phishing and SIM-swap scams work in Nigerian banking. Subscribe so you don’t miss it, and tell me in the comments which topic you want explained next.