[RainaRelanah]

But there are protections against this, such as HSTS. I would expect someone with as much sensitive information as Equifax to have HSTS + HPKP pinned into the major browsers. Their server should never even receive an HTTP request. It's just unrivaled incompetence.

[discreditable]

HSTS doesn't help if it's your first visit to the site. To work around that they'd need to get into a preload list.

[andygambles]

Which is easy if you set preload header.

[tony101]

This. The technology (HSTS, HPKP, Subresource Integrity, upgrade-insecure-requests) is there; sites that need it just don't seem to use it.