Hackers exploited a vulnerability in ApacheStrut, an open-source software tool Equifax used to build web sites. The software bug in question had been publicly identified in March, and a patch to fix it had been available since then. Equifax has said that it tried to patch the bug two months before it discovered the breach, but that it has not deduced why the patch was unsuccessful, and that it promises to share its findings as it continues its investigation of the incident.