What We Know and Don’t Know About the Equifax Hack<br />Had Equifax followed the advice of the community of software developers who oversee Struts, “this breach<br />would not have occurred,” said Oege de Moor, the chief executive of the security firm Semmle.<br />• Hackers exploited a vulnerability in website software.<br />• It is also unclear why the company did not patch the vulnerability and why other security methods failed to stop the attack.<br />• It is not clear who had access to the website software exploited by the hackers.<br />Intelligence officials and security analysts in private industry said<br />that while it is far too early to say definitively who breached Equifax, the leading theory is that the company was hit by a nation-state or hackers operating on a nation-state’s behalf.
