Equifax: 147 Million Social Security Numbers and the Myth of Perimeter Security

The Breach

On September 7, 2017, Equifax disclosed that attackers had accessed personal information of 147 million Americans — including Social Security numbers, birth dates, addresses, and driver's license numbers. The breach exploited an unpatched Apache Struts vulnerability (CVE-2017-5638) and persisted undetected for 78 days.

The Impact

• 147 million Americans' SSNs exposed — nearly half the U.S. population
• $575 million FTC settlement
• 78 days of undetected lateral movement
• Attackers moved between 51 databases using stolen internal credentials
• CEO, CIO, and CISO all resigned

Why Traditional Security Failed

After exploiting the web vulnerability, attackers moved laterally through Equifax's network using stolen internal credentials. The perimeter was breached once, and nothing inside verified that the humans accessing databases were who they claimed to be.

1. Static credentials: Internal users authenticated once and had persistent access
2. No behavioral monitoring: Anomalous data access patterns went undetected
3. Lateral movement: One compromised credential cascaded across 51 databases
4. 78-day dwell time: No continuous verification challenged the attacker's identity

How KAVI Protocol Prevents This

Continuous Authentication

KAVI doesn't authenticate once and trust forever. The behavioral model continuously evaluates whether the person interacting with the system matches the established Surprise Signature. An attacker using stolen credentials would exhibit fundamentally different behavioral patterns — different typing cadence, different navigation patterns, different interaction rhythms. The anomaly would be detected within seconds, not 78 days.

Per-Operation Key Derivation

Each database query under KAVI would require a fresh Ghost Key derived from the user's live behavior. An attacker can't simply authenticate once and freely access 51 databases — every operation demands fresh behavioral proof of identity.

Data-Bound Encryption (Trinity Binding)

Trinity Binding ensures that access keys are cryptographically bound to specific data contexts. A key derived for accessing one database is mathematically useless for accessing another. Lateral movement becomes cryptographically impossible.

Conclusion

The Equifax breach demonstrated that perimeter security is necessary but insufficient. Once an attacker is inside, static credentials provide no resistance. KAVI's continuous behavioral verification and per-operation key derivation create security that works from the inside out — every action must be continuously proven, not assumed.