Smith, Equifax's former CEO, told Congress in October the alert was sent the next day via email to the Equifax personnel who oversee security of the application, known as Apache Struts. Equifax's policy is such security updates be made within 48 hours.