Hacker News Reader

The statement released by Apache said that, if the attack did use the REST plugin vulnerability in Struts, then it would have been a zero-day at the time of use.

View on HN

You will note that Equifax is not a contributor to Struts - cash or code. They are trying to shift the blame onto something they got for free and work other people did for free.

It's my understanding that Equifax is a multibillion dollar org. (Something in the order of 17 billion USD). Since Struts is a major part of their business infrastructure one would expect a contribution to the Struts project and other software they rely on. They could spin it as "Social Responsibility" too.

In retrospect it seems more cost effective to do so too, even if Equifax manages somehow to pay only a few hundred million dollars.

Yet Equifax continues to evade giving details on the attack. That itself is damning evidence they weren't doing everything they should have been to protect their servers and data.

Reply on news.ycombinator.com