Yes—according to a December 2018 Republican staff report for the House Oversight Committee, the 2017 Equifax breach could have been prevented. The report said Equifax had observable security problems, including expired monitoring certificates and weak accountability, that were not corrected in time. That conclusion was a congressional committee finding, not a court judgment or a definitive statement about criminal responsibility.
What the House report concluded
The House Oversight Committee Republicans’ 14-month staff investigation stated: “Had the company taken action to address its observable security issues prior to this cyberattack, the data breach could have been prevented.” The wording places the focus on preventable organizational and technical failures rather than treating the intrusion as unavoidable.
The committee’s release also described an execution gap between information-technology policy and day-to-day operations. Unclear lines of authority made it harder to implement security initiatives promptly and comprehensively. Equifax’s growth, acquisitions, complex environment and custom-built legacy systems added to the difficulty of securing and monitoring its network.
How attackers reached Equifax
According to the Government Accountability Office (GAO), Equifax system administrators discovered in July 2017 that attackers had gained internet access to the company’s online dispute portal. GAO grouped the major contributing weaknesses into four areas:
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- Cross-cut paper and credit card shredder cuts material into approximate 0.2 x 0.7 inches (5 x 18 mm) pieces; meets security level P-4 standards
- Shreds up to 8 sheets of 20-pound bond paper at a time; shreds credit cards (one at a time, but not suitable for metal credit cards), staples, and small paper clips
- 3 minute runtime and 30 minute cool down; if unit goes beyond max run time, it automatically shuts off to prevent overheating
- 4 mode control switch (auto/on, off, reverse, forward) and LED status indicators for power on, overheat and overload; easy to empty 3.7 gallon bin
- Quality tested: As part of Amazon Basics quality inspections, we test every shredder before shipping it, which means you may see some paper shreds from the testing
- Identification: security weaknesses were not adequately identified and addressed.
- Detection: monitoring failures delayed recognition of malicious activity.
- Database access segmentation: access controls did not sufficiently limit movement toward sensitive data.
- Data governance: the organization’s handling and oversight of sensitive information were inadequate.
The House committee identified one especially damaging monitoring failure. It said Equifax had more than 300 expired security certificates, including 79 used to monitor business-critical domains. One expired certificate left the company without visibility into data exfiltration for 19 months. Without that inspection capability, attackers could remove information without the normal monitoring control detecting it.
CyberScoop reported that the House report mentioned suspicious traffic from at least one Chinese IP address during the response. That clue did not establish who conducted the intrusion, so it should not be treated as conclusive attribution.
How many people were affected?
The figures differ because the sources were counting at different points and using different descriptions of the incident.
Rank #2
- Cross-cut paper and credit card shredder cuts material into approximate 0.2 x 0.7 inches (5 x 18 mm) pieces; meets security level P-4 standards
- Shreds up to 8 sheets of 20-pound bond paper at a time; shreds credit cards (one at a time, but not suitable for metal credit cards), staples, and small paper clips
- 3 minute runtime and 30 minute cool down; if unit goes beyond max run time, it automatically shuts off to prevent overheating
- 4 mode control switch (auto/on, off, reverse, forward) and LED status indicators for power on, overheat and overload; easy to empty 3.7 gallon bin
- Quality tested: As part of Amazon Basics quality inspections, we test every shredder before shipping it, which means you may see some paper shreds from the testing
| Source and year | Figure | What it represents |
|---|---|---|
| Equifax’s initial announcement, as cited in the 2018 House committee release | 143 million consumers | Initial estimate of people affected |
| House Oversight Committee Republicans, 2018 | 148 million consumers | Later figure cited by the committee; described as nearly half the U.S. population and 56% of American adults |
| U.S. Government Accountability Office, 2018 | At least 145.5 million individuals | Minimum number whose personal information attackers accessed |
These numbers should not be silently combined. The committee’s 148 million figure and GAO’s minimum access figure come from separate government publications with different purposes and reporting points.
Why the failure was broader than one expired certificate
Accountability problems
The committee said unclear responsibility restricted timely implementation of security measures. A policy can exist on paper while failing operationally if no team clearly owns deployment, verification and escalation.
Legacy complexity
The report linked Equifax’s acquisitions and custom-built legacy systems to a complicated technology environment. Complexity does not itself cause a breach, but it makes asset inventories, patching, certificate renewal and access reviews harder to coordinate.
Rank #3
- 【Cross Cut & Credit Card Paper Shredder】The cross cut shredder shreds paper into 5x14mm particles, achieving P-4 level security. Shreds up to 6 sheets at once without removing staples, also handling paper clips and credit card (one at a time)
- 【Continuous Performance】The operating time is 4 minutes, with a 20-minute cooling cycle. If the shredding time exceeds 4 minutes, the overheating indicator will light up. After a 20-minute cooling cycle, it can resume operation
- 【Easy to Clean & Place】 Bonsaii shredder’s head features a handle for easy lifting; the separate 3.4-gallon bin has a clear window for quick disposal. Compact dimensions (11.81" × 7.09" × 14.26") make it perfect for home and small office spaces, fitting neatly under desks.
- 【Easy Operation & Safety Features】Auto start/stop and manual-reverse functions protect the paper shredder from the frustration of paper jams. The overheat protection function effectively extends the lifespan of the shredder, The document shredder will stop working once you lift the head, ensuring your safety.
- 【1-Year Warranty】Bonsaii offers a 1-year warranty for your shredders for home use heavy duty. If you have any questions, please feel free to contact us. We test every shredder before shipping, so you may notice some paper shreds from the testing
Insufficient containment
GAO’s findings indicate that once attackers reached the dispute portal, weaknesses in segmentation and data governance helped enable access to and extraction of sensitive information. Effective segmentation is intended to prevent a compromise of one internet-facing system from opening a path to broad databases.
What happened when Equifax disclosed the breach
The House committee found that Equifax was not prepared to support consumers after public disclosure. Its breach website and call centers were overwhelmed. That response failure did not create the intrusion, but it increased the practical burden on people trying to determine whether they were affected and what protective steps to take.
Recommended Free Tools
GAO separately reviewed Equifax’s response and federal-agency actions. Its findings place the incident in two phases: preventing or containing unauthorized access, and providing usable information and assistance after disclosure.
Rank #4
- Strip-cut paper shredder with P-2 security level; creates 0.24 inch wide strips
- Shreds up to 8 sheets of 20-pound bond paper at a time, including staples and small paper clips; also destroys CDs, DVDs, and credit cards, one at a time (not suitable for metal credit cards)
- 3.4-gallon easy-empty bin
- 2.5 minute runtime / 15 minute cool down; auto shut off protects the motor from overheating
- Note: Please refer to the user manual, troubleshooting guide, and instructional video before use
What consumers could do after exposure
GAO identified fraud alerts and credit freezes as available mitigation options. A fraud alert asks creditors to take additional steps to verify a person’s identity before extending new credit. A credit freeze restricts access to a consumer report until the person lifts the freeze, subject to applicable rules and exceptions.
Consumers could also complain to the Federal Trade Commission or the Consumer Financial Protection Bureau. GAO noted an important limitation: people generally cannot choose which consumer-reporting agencies maintain their data, nor can they remove themselves entirely from the consumer-reporting market.
Because the breach and the cited audits are historical, current procedures, fees and identity-verification requirements should be checked with the relevant federal agencies and credit bureaus before taking action. Paid monitoring or identity-protection services may be optional, but the cited government findings do not establish any particular provider as necessary or superior.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesBest Value
- Cross-cut paper and credit card shredder cuts material into approximate 0.2 x 1.2 inches (5 x 30 mm) pieces; meets security level P-3 standards
- Shreds up to 12 sheets of 20-pound bond paper at a time, also can shred credit cards (one at a time, but not suitable for metal credit cards), staples, and small paper clips
- 9 minute runtime and 30 minute cool down; if unit goes over max run time, it automatically shuts off to prevent overheating
- 4 mode control switch (auto/on, off, reverse, forward) and LED status indicators for power on, overheat and overload; 5 gallon bin reduces empty frequency
- Quality tested: As part of Amazon Basics quality inspections, we test every shredder before shipping it, which means you may see some paper shreds from the testing
What “entirely preventable” does—and does not—mean
“Entirely preventable” is the House staff report’s characterization of the security conditions surrounding the breach. It means the committee believed observable weaknesses could have been corrected before the attack. It does not mean the report was a judicial ruling, that every technical detail of the intrusion is publicly known, or that the committee conclusively identified the attackers.
The most defensible summary is narrower: government investigations found a chain of identifiable failures—especially monitoring, accountability, segmentation and data governance—that allowed an attack on an internet-facing Equifax system to expose information on at least 145.5 million people, with the House committee later citing 148 million affected consumers.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
