Skip to main content
1 of 3
Steffen Ullrich
  • 207.5k
  • 30
  • 416
  • 481

Because of expired certificates, the Equifax IPS was unable to inspect encrypted traffic and detect the breach in time.

It is hard to tell from the report what exactly was going on but I read it a bit differently. I don't think that the expired certificate was used to decrypt traffic at all as you seem to assume. From page 3:

Equifax did not see the data exfiltration because the device used to monitor ACIS network traffic had been inactive for 19 months due to an expired security certificate.

In my understanding this describes a device which connects with TLS to some part of this ACIS network in order to monitor information. The certificate for this connection was expired so that the device could no longer connect to the ACIS network and thus could no longer monitor it.

Steffen Ullrich
  • 207.5k
  • 30
  • 416
  • 481