And he joined Equifax after jumping ship from A. G. Edwards in 2008, presumably because the company was accused of fraud in that same year.

His first security gig was Senior IT Security Analyst at A. G. Edwards and Sons. His only work experience before that was Supervisor of Branch Installations.

This seems unbelievable, but that senior security position was his first IT experience.

Could this be a scheme to sell customer data?

I assumed for some time that installing backdoors is a good way to sell customer data you otherwise wouldn't be allowed to share.

Equifax didn't fall victim to a backdoor but to an outdated Apache Struts that no one noticed.

I'm not only talking about this particular case, but in general. "Accidental" backdoors let companies share data they legally couldn't share.

Look at Facebook and how their API was surprisingly abused for years until they noticed it.

“The biggest concern is credit card data, a breach occurring on a digital property is devastating to companies.”

Mike Gustavison , Director of Info Sec , Panera Bread