Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

CUSTOMER ADVISORY: Customers and the Equifax Breach - Steps You Can Take Now to Reduce the Risk

    • Updated:
    • 20 Sep 2017
    • Product/Version:
    • Deep Discovery Inspector All.All
    • Deep Security All.All
    • Deep Security as a Service All.All
    • InterScan Messaging Security Virtual Appliance All.All
    • InterScan Web Security Virtual Appliance All.All
    • OfficeScan All.All
    • ScanMail for Exchange All.All
    • TippingPoint Advanced Threat Protection for Network All.All
    • Worry-Free Business Security Standard/Advanced All.All
    • Platform:
    • N/A N/A
Summary
By now, most consumers and IT administrators have heard or read about the massive breach reported by Equifax, one of the three major credit reporting bureaus in the United States, on September 7, 2017.  
Over 140 million consumers' private data are said to potentially have been accessed in a breach that reportedly happened around the summer, and is the most significant known compromise of American consumers' personal information to date.
The following article lists some recommended steps for individuals who may be at risk and some additional steps to help reduce your risk of identify theft.
Details
Public

Am I Affected?

Equifax has set up a landing site specifically with information on the breach, with a link called "Potential Impact" that allows users to input additional information to see if they may have been affected.

 

Ongoing Monitoring and Best Practices

It is highly recommended that consumers regularly review their credit reports and other critical financial information (such as banking and credit card security logins) on a regular basis to ensure for potential warning signs such as unknown new accounts or credit lines being opened.  

There are several options that consumers may use to proactively monitor their credit.  Some -  such as the TrustedID program which Equifax is offering at no charge for a limited time - are connected or linked to one of the three major credit bureaus.  There are also popular 3rd party/independent services available for consumers who are not comfortable using a service directly affiliated with one of the bureaus.

In addition, many companies are starting to make identify theft and credit monitoring services available as included or optional parts of many employee benefit programs.  With fall open enrollment dates coming up in Q4, it may be a good time to check to see if your company has this as a benefit.

 

Trend Micro Protection

Equifax themselves have reported that the attack vector that was believed to have been used in the attack was a vulnerability in Apache Struts (CVE-2017-5638), an open-source application framework that supports the Equifax online dispute portal web application. This particular vulnerability was reported earlier in 2017.

Administrators are always encouraged to patch and address vulnerabilities as quickly as possible when they are aware of a potential issue.  

The first recommendation is always to apply the vendor's specific patch(s) if they are available.  As an additional line of defense, customers who have deployed virtual patching and other intrusion defense systems such as Trend Micro's Deep Security, Vulnerability Protection or TippingPoint products have had protection against CVE-2017-5638 and other similar critical vulnerabilities for several months now, shortly after the vulnerabilities were publicly disclosed.  Customers using these products should also ensure they have the latest rules and/or filters applied for the most up-to-date protection.

 

Additional Information

Trend Micro has some comprehensive blog entries that covers this breach in more detail and provides some additional recommendations for administrators and consumers alike:  

Premium
Internal
Rating:
Category:
Troubleshoot
Solution Id:
1118369
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.