From the Equifax webpage[1]: Criminals exploited a U.S. website application vulnerability to gain access to certain files.

[1]: https://www.equifaxsecurity2017.com/

This is inexcusable in 2017. Hacking humans may be easier but it's up to Equifax to figure out how to mitigate that risk. "It's hard" doesn't excuse their behavior.