The US credit reporting bureau, Equifax, has announced that it expects the cost of its 2017 data breach will be around US$275 million this year and well over US$600 million in total, making it the most costly corporate hack in history.

In September this year, Equifax disclosed that the personal information of more than 147 million consumers in the US, UK and Canada was stolen, including names, dates of birth, addresses, social security numbers, driver’s licence details and credit card numbers. As this information can personally identify individuals, the company may also face fines and civil lawsuits.

The Government Accountability Office (GAO), the agency that provides auditing and investigative services for Congress, has released a report about the Equifax hack. The attack started on 10th March, 2017, when hackers searched the web for any servers with vulnerabilities. Two months later, on 13th May, they found a way in via Equifax’s dispute portal, where people go to argue about claims. The hackers exploited an Apache Struts vulnerability, an issue that Equifax knew about but hadn’t fixed, and so accessed the login credentials for three servers. They found that those credentials allowed them to access a further 48 servers containing personal information.

It took 76 days for Equifax to detect the hackers inside their network and the GAO reports that the hackers stole the data individually from 51 databases so they wouldn’t raise any alarms.

Read our guide and stay ahead of the increasingly sophisticated criminal attacks.