Incident brief
Equifax disclosed on September 7, 2017 that criminals had exploited a vulnerability in a US website application and accessed files containing consumer information. Its initial estimate was approximately 143 million US consumers. The company described unauthorized access from mid-May through July and said it discovered the activity on July 29. Those are different dates: an intrusion period, a detection date and a public disclosure, not three publication dates for this article. The initial filing also said the investigation was continuing, so its population estimate should be read as an opening count rather than a final census.
What the record establishes
The company's SEC-filed release listed names, Social Security numbers, birth dates and addresses among the affected fields, with driver's license numbers in some cases. It separately described payment-card numbers and dispute documents for smaller groups. Equifax said it had found no evidence of unauthorized activity in its core consumer or commercial credit-reporting databases. That qualification did not negate the sensitivity of the files reached through the web application. The source is the company's own disclosure, not an independent forensic reconstruction. Later revisions to the affected population should not be silently projected backward into this first-day account.
Defensive reading
The operational question is how an exposed application, the data it can query and the organization's detection path are mapped together. Asset owners need a reliable inventory of externally reachable applications, responsibility for vulnerability remediation, and a way to confirm that a patch was actually applied to the running service. Equally important is knowing which sensitive datasets a service can read and how unusual access would be logged and escalated. A green patch dashboard is weak evidence if it excludes an application or cannot connect that application to the records behind it.
What remains bounded
The disclosure does not, by itself, establish every root-cause or governance failure later discussed in hearings and litigation. It does show that the first public number and the final impact assessment can differ materially. A retrospective should preserve the chronology and link to the original release rather than present this site as having reported the event in 2017. The useful lesson is an evidence trail from application exposure to data access, discovery and revised scope.