SAN FRANCISCO — Hackers took advantage of an Equifax security vulnerability two months after an industry group discovered Vulnerability-related.DiscoverVulnerability the coding flaw and shared Vulnerability-related.PatchVulnerability a fix for it , raising questions about why Equifax did n't update Vulnerability-related.PatchVulnerability its software successfully when the danger became known . A week after Equifax revealed one of the largest breaches Attack.Databreach of consumers ' private financial data in history — 143 million consumers and access Attack.Databreach to the credit-card data of 209,000 — the industry group that manages the open source software in which the hack occurred blamed Equifax . `` The Equifax data compromise Attack.Databreach was due to ( Equifax 's ) failure to install the security updates provided Vulnerability-related.PatchVulnerability in a timely manner , '' The Apache Foundation , which oversees the widely-used open source software , said in a statement Thursday . Equifax told USA TODAY late Wednesday the criminals who gained access Attack.Databreach to its customer data exploited Vulnerability-related.DiscoverVulnerability a website application vulnerability known as Vulnerability-related.DiscoverVulnerability Apache Struts CVE-2017-5638 . The vulnerability was patched Vulnerability-related.PatchVulnerability on March 7 , the same day it was announced Vulnerability-related.DiscoverVulnerability , The Apache Foundation said . Cybersecurity professionals who lend their free services to the project of open-source software — code that 's shared by major corporations and that 's tested and modified by developers working at hundreds of firms — had shared their discovery with the industry group , making the risk and fix known to any company using the software . Modifications were made on March 10 , according to the National Vulnerability Database . But two months later , hackers took advantage of the vulnerability to enter the credit reporting agency 's systems : Equifax said the unauthorized access began in mid-May . Equifax did not respond to a question Wednesday about whether the patches were applied Vulnerability-related.PatchVulnerability , and if not , why not . `` We continue to work with law enforcement as part of our criminal investigation and have shared indicators of compromise with law enforcement , '' it said . It should have have acted faster to successfully deal with the problem , other cybersecurity professionals said . `` They should have patched Vulnerability-related.PatchVulnerability it as soon as possible , not to exceed a week . A typical bank would have patched Vulnerability-related.PatchVulnerability this critical vulnerability within a few days , ” said Pravin Kothari , CEO of CipherCloud , a cloud security company . Federal regulators are now investigating whether Equifax is at fault . The Federal Trade Commission and the Consumer Financial Protection Bureau have said they 've opened probes into the hack . So far dozens of state attorneys general are investigating the breach , and on Tuesday Massachusetts Attorney General Maura Healey said she plans to sue the company for violating state consumer protection laws . More than 23 class-action lawsuits against the company have also been proposed . Proof that Equifax failed to protect customers , particularly when it had the tools and information to do so , is likely to further damage Equifax 's financial outlook . Shares fell 2.5 % Thursday after news of the FTC probe and are down 33 % since it revealed the link .