Also Friday, Georgia Attorney General Chris Carr said his office has joined a coalition of 36 state attorneys general in a probe of the massive data breach.
In a statement Friday, Carr's office said the nature of the probe so far is civil, not criminal, and it will examine "all facts and circumstances surrounding the breach, and its impact on Georgia consumers."
“Our primary responsibility is to protect the consumers of Georgia, millions of whom, through no fault of their own, have had their personal information compromised,” he said.
In its statement, Equifax outlined new details from its internal probe. The company said that on July 29, its security team “observed suspicious network traffic associated with its U.S. online dispute portal web application,” and took action to block it. More suspicious traffic followed the next day, and Equifax said it took the affected web application offline.
The company said a security flaw in an application called Apache Struts, an open-source server software, was the initial “attack vector.” Equifax said it patched the application and returned it to service.
Equifax and Apache Software Foundation have blamed each other this week for the vulnerability.
Apache said Thursday it provided a patch for the software fault on March 7, well before Equifax said the security breach began in mid-May.
“Equifax’s Security organization was aware of this vulnerability at that time, and took efforts to identify and to patch any vulnerable systems in the company’s IT infrastructure,” the company statement said. “While Equifax fully understands the intense focus on patching efforts, the company’s review of the facts is still ongoing.”
Before her retirement from the company was announced Friday, Equifax took heat from a number of publications for Mauldin's background. On her LinkedIn page, Maudlin listed a pair of music composition degrees from the University of Georgia, including a masters of fine arts.
The page does not list an IT or computer science degree.
The LinkedIn page, which is now private and removed her last name, also listed executive work at financial giants First Data and SunTrust Banks.