On Sept. 7, 2017, the world heard an alarming statement from credit scores giant Equifax: In a brazen cyberattack, any person had stolen sensitive personal information from extra than 140 million people, nearly half of the population of the U.S.
It turned into the purchaser information security scandal of the decade. The facts protected Social Security numbers, motive force’s license numbers, information from credit disputes and other private info. CEO Richard Smith stepped down below fireplace. Lawmakers modified credit score freeze laws and instilled new regulatory oversight of credit score scores agencies.
Then, something unusual came about. The statistics disappeared. Completely.
CNBC talked to eight specialists, including information “hunters” who scour the dark web for stolen statistics, senior cybersecurity managers, pinnacle executives at economic establishments, senior intelligence officials who performed a component inside the investigation and specialists who helped aid it. All of them agreed that a breach occurred, and personal statistics from 143 million people became stolen.
But none of them is aware of in which the information is now. It’s never regarded on any loads of underground websites promoting stolen records. Security professionals haven’t visible the records used in any of the approaches they had counted on in theft like this — no longer for impersonating victims, no longer for having access to different websites, not anything.
But because the investigations hold, a consensus is starting to emerge to give an explanation for why the statistics have disappeared from sight. Most professionals acquainted with the case now agree with that the thieves were running for a foreign authority and are the usage of the statistics no longer for economic benefit, however, to try to become aware of and recruit spies.
One records hunter dives in
The missing Equifax facts have been a 17-month-lengthy obsession for Jeffrey, a cybersecurity analyst at one of the international’s biggest banks. To him, it represents a type of professional Lost City of Atlantis or Holy Grail.
Jeffrey isn’t the analyst’s actual name. He asked to remain nameless due to the fact he was now not authorized to speak to the media. He also asked that his bank continue to be nameless, due to the fact he’s one in all this sort of narrow pool of a particular sort of employee that even the name of his bank could be used to pick out him.
Jeffrey is a “hunter” at the bank’s “hunt group,” and his task is searching for records on the darkish net or darknet — a hard and fast of websites that may handiest be accessed with unique software that protects the person’s anonymity. The dark internet can be used for lots functions, but maximum prominently serves because the net’s underground black marketplace, wherein criminals purchase, sell and alternate credit card statistics, non-public facts, and criminal services.
Jeffrey trolls the dark internet for stolen private statistics that looks like it might be modern-day, in particular, if it looks like it might belong to customers of the financial institution or its competitors. He is frequently one of the first to recognize that some other enterprise has been breached, and his crew is often some of the first to tell the victims that their structures were breached.
So Jeffrey changed into amazed while he learned about the Equifax breach at the identical time as all people else, while the enterprise announced it to the arena.
Stolen client information usually goes up for sale at once after an agency is hacked, he explains. Criminals purpose for pace so we can promote the records earlier than a company’s tripwires ever discover it turned into stealing. The longer they wait, the much more likely the victims and the establishments will make modifications to render the facts useless. This is, in particular, true with credit score card numbers, that could quickly be canceled as soon as fraudulent fees begin cropping up on them. Or while Social Security numbers — like those stolen inside the Equifax breach — begin getting flagged for fraud.
Equifax said it had first recognized the assault in July, and it may have started even earlier than that. Jeffrey said he had every now and then visible fact on the market from the credit reporting bureaus, other banks and companies that deal in credit score rankings, like loan servicers. But he had by no means seen any information that appeared find it irresistible had come from Equifax on any criminal forum.
“Of route I thought this information was stolen via criminals. Even if there may be [a nation-state] in the back of it, that is absolutely precious stuff, and the criminals and countryside stuff may be truly combined. Or, a nation-state might promote it simply to save face. This stage of statistics is really worth a lot extra than most,” Jeffrey recollects questioning on the time.
Jeffrey had simplest recently commenced his career as a hunter, but he turned into sure he’d discover something on Equifax. He hunted at work, and he hunted at home. He asked his friends. He bothered human beings he met online.
He made no progress.
Jeffrey was no longer alone.
“We were operating very closely with authorities — federal authorities, country authorities — in addition to our partners and clients, and our personal very advanced risk intelligence group,” Jamil Farshchi, the chief information protection officer of Equifax, instructed CNBC.
“We are all working in an effort to continually determine whether or not this record is offered and whether or not it has ever been accessible. And presently there has been actually no indication, by any means, that the records have been disclosed, that it’s been used or that it has been offered on the market.”
Two leading theories
As quickly as the investigation started, in September 2017, stakeholders had plenty of theories approximately who stole the records and why. Those theories subsequently grouped into facets.
Jeffrey, who formerly served in regulation enforcement, tends to peer the arena in shades of criminals as opposed to law enforcement officials. Like maximum different people with this type of background, he believed the information became stolen by criminals and turned into no longer turning up for sale on the darkish internet due to the fact the hackers feared that the records turned into too hot, and that regulation enforcement would without delay trap them — just like the thief who stole the Mona Lisa.
The other idea, desired by using investigators with an intellectual heritage, centered on intelligence officers working for an overseas geographical region.
As numerous independent investigations wound down, the experts following the case got here to a general consensus that breaks up the middle. The breach possibly began with a low-level criminal who exploited a vulnerability in Equifax’s defenses but turned into now not experienced or capable enough to do more damage with the aid of shifting similarly during the employer. This crook then sought help through the criminal underground and shared or sold statistics approximately the vulnerability. The purchaser turned into in all likelihood a proxy for the Russian or Chinese authorities.
That buyer used ways extra state-of-the-art gear and strategies to hack deeper into Equifax’s databases and exfiltrate — an enterprise time period for “scouse borrow” that implies shifting huge amounts of data undetected — the now-notorious terabytes of consumer credit score statistics.
One former senior intelligence authentic with direct knowledge of the Equifax investigation summarized the triumphing professional opinion on how the foreign intelligence employer is using the facts. (This man or woman requested to talk on the circumstance of anonymity due to the fact he is not legal in his contemporary position to talk to media.)
First, he stated, the foreign authorities might be combining this information with other stolen information, then reading it the usage of artificial intelligence or system gaining knowledge of to discern out who is likely to be — or to become — a spy for the U.S. Government. He pointed to other records breaches that targeted on facts that might be useful for figuring out spies, inclusive of a 2015 breach of the Office of Personnel Management, which approaches the lengthy safety clearance applications for U.S. Authorities officers.
Second, credit reporting data affords compromising statistics that may be used to show precious people into agents of an overseas government, influencers or, for decrease-degree personnel, statistics thieves or informants. In precise, the credit score information may be used to identify human beings in key positions who have extensive financial problems and could be compromised by bribes or excessive-paying jobs, the previous reputable stated. Financial distress is one of the maximum not unusual reasons people dedicate espionage.
The Equifax records afford information that would perceive people who are not even in those positions or have an effect on but, he stated, and may be precious for years to come.
About that credit score freeze
If this leading principle is proper, the handiest people who needed to fear about the Equifax breach were people in touchy authorities positions or with plenty of getting entry to, have an effect on and power: destiny senators, remote places CIA officers, those who oversee U.S. Corporate statistics facilities or senior monetary executives of technology organizations, for instance.
The fevered classified ads that entreated clients to test whether or not their facts had been compromised and take several steps to freeze it and display it turns out to have been unnecessary for this breach — as a minimum thus far.
Still, Farshchi stated credit freezes and tracking offerings are still a nice way to determine whether personal records have been stolen or your identity misused. Experts out of doors Equifax have long agreed.
As for Jeffrey, he stated he and a lot of his contemporaries will preserve looking for the records, in all likelihood on their own time. About as soon as per week, he says, he gets up early with a cup of espresso and sets his sights on his traditional darkish web haunts with Equifax in mind.
Knowing that an intelligence corporation in all likelihood has the records, he said he is additionally analyzing the information extra frequently. He appears for tales about bribery, graft, spies being caught or politicians abruptly spouting rhetoric in the protection of hostile countries in which they hadn’t earlier than.
“I think I’m going to be looking a few news feeds someday a decade from now and notice that a few flesh-presser is trying to perform a little crazy deal with some country we supposedly don’t like,” he wrote through secured text message. “And I’m honestly going to wonder: am I subsequently looking on the Equifax records, in any case, this time?”