“We now know that the vulnerable version of Apache Struts within Equifax was not identified or patched in response to the internal March 9 notification,” he said. The vulnerability remained in Equifax’s systems "much longer than it should have," Smith added, and its failure to be patched allowed hackers to access consumers’ most sensitive data.

Smith said he was first informed there was suspicious activity on July 31 in a conversation with his chief information officer, two days after Equifax’s security department saw it. He said he didn’t know that personal identifying information, like Social Security numbers, had been taken until Aug. 15.

The company contacted the FBI and hired outside counsel and security experts on Aug. 2, Smith said. He began notifying Equifax’s board of directors on Aug. 22, and convened a board meeting to discuss the scale of the breach on Sept. 1.

‘Enormous Hack’

Smith also said the company was “disappointed” with how its website and call centers were managed in the wake of the breach. In the days after the breach, consumers weren’t able to access the website the company set up to help identify who was hacked and the firm had trouble handling the massive influx of calls.

“The scale of this hack was enormous and we struggled with the initial effort to meet the challenges that effective remediation posed,” Smith said in the remarks. “The rollout of these resources should have been far better, and I regret that the response exacerbated rather than alleviated matters for so many.”