A Year After Equifax Breach, No Enforcement Actions ​​​​​​​

A new report by congressional investigators details how hackers broke into Equifax last year in a breach that exposed the financial information of more than 145 million Americans.

The lawmakers who requested the report say they will press the Trump administration on the lack of enforcement actions against the giant credit-reporting agency.

Shares of Equifax plunged by about one-third last year after news broke about the massive breach. Since then, the stock has recovered to about $10 below its peak before all the bad news and closed last week at $135.91 a share. The company has reported a profit of $236 million this year, and second-quarter profit was down just 12 percent from the same period last year despite the breach.

Here is what you need to know about the breach and events since then:

HOW DID HACKERS BREAK IN?

The Government Accountability Office, the investigative arm of Congress, confirmed that a server hosting Equifax’s online dispute portal was running software with a known weak spot. The hackers, who have not been identified, jumped through the opening. Hiding behind encryption tools, they sent 9,000 queries to dozens of databases containing consumers’ personal information, then methodically extracted the information.

The attack went unnoticed by Equifax for more than six weeks.

Equifax officials told GAO the company made many mistakes. Some were as simple an outdated list of computer systems administrators — when the company circulated a notice to install a patch for the software vulnerability, the employees responsible for installing the patch never got it.

WHAT HAS EQUIFAX DONE?

The company has said in regulatory filings that it has taken steps to fix the issues that allowed the breach to occur. Equifax said it has added tools to better monitor network traffic, restrict traffic between internal servers, and tighten controls on who can access certain systems and networks.