Attackers exploited an unpatched Apache Struts 2 RCE vulnerability that had a patch available for two months. They moved laterally through Equifax's network for 78 days undetected, stealing personal data on 147.9M Americans. Costs include a $700M FTC settlement, $1B in security improvements, and a 35% stock drop erasing ~$5B in market cap. The CIO was convicted of insider trading.
VULN_RECENT_FREQUENCY + maintainer health preconditions
| Tool | Verdict | Details |
|---|---|---|
| OSS Risk Guard | Caught | VULN_RECENT_FREQUENCY + maintainer health preconditions |
| Socket | After damage | Detects after CVE published |
| Snyk | After damage | CVE detection after publication; reactive not proactive |
| Sonatype (Nexus) | After damage | Detects after CVE published |
| Black Duck | After damage | Detects after CVE published |
| Endor Labs | After damage | CVE detection + reachability analysis after publication; reactive |