Slashdot Mirror
Consumer Database Company Hacked Again
x-guru writes "CNN is reporting on the indictment of a Florida man on 144 identity theft charges including fraud, money-laundering, and obstruction of justice. Approximately 8.2 GB of data was stolen from Acxiom Corp, a company responsible for the storage of vast amounts of personal, financial and corporate data. It looks to be an inside job as six Acxiom employees have agreed to cooperate with the investigation." Acxiom was hacked last year as well.
of course i can't be bothered to RTFA, but when will we have laws making it a mandatory requirement for companies like this to fully disclose events like this to the public. after all, it is our information they're "losing"
It looks to be an inside job as six Acxiom employees have agreed to cooperate with the investigation.
It might just be the early morning talking, but could someone explain how employee cooperation implies an inside job? Maybe I need more coffee.
...Whether my Maker is prepared for the great ordeal of meeting me is another matter.
Churchill
Federal officials said the theft of approximately 8.2 gigabytes of data resulted in losses of more than $7 million.
Where exactly is $7 million coming from? Is there data worth about a million a gig?
Comment removed based on user account deletion
This is the great myth of the InterWeb security policies of most corporations -- you're only as safe as the weakest link in the chain. IBM, GE, et al, are probably among the most secure commercial sites available, and yet their customers still get nailed by third-party lapses.
Anyone want to take a gander on when Equifax, Experian, and TransUnion get busted for going through some minor service provider?
... is to not store it all in one place.
Centralised databases of sensitive data are evil.
-- MartinG To mail me: echo kewyjlcxyzvjfxbqwh | tr bcefhjklqvwxyz
This is where the lack of security is undershot. Secuity is always talked about with the consumer pc, windows and ie. If you want to get personal data hack the server. Forget the pc. I don't hear much about these area being convered. Banks and the Military seem to have security covered but there are a lot of orginizations with a lot of personal data with not near enough security.
Evolution or ID?
Comment removed based on user account deletion
What is happening to the morons who leave this kind of information sitting around on an easily cracked server? Are they getting fines? Jail time? 40 lashes with a wet noodle? What?
Maybe if these network admins were PUNISHED SEVERELY for their negligence they'd start being more careful.
At the very least this kind of information should be stored on encrypted filesystems. Better still, the files themselves should be triple-des'd and then PGP'd for good measure.
What the crap? Did the theft actually occur or was he indicted on CONSPIRACY to steal the data?
and I quote...."A Florida man was indicted Wednesday in an alleged scheme to steal vast amounts of personal information, and the Justice Department said it might be the largest illegal invasion and theft of personal data to date"
Use of the word scheme leads me to believe this is a conspiracy crime and that no actual theft occured. Anyone else want to weigh in on that?
How about a quick game of Hangman, kids. "Here's hoping he gets time in a federal _____-__-__-___-___ prison!" (Commence flames from more enlightened readers in 3... 2... 1...)
if they used a wide-open, everyone-can-see security that only Linux can provide...
Feel safe with RMS and ESR.
-discuss and explain
Beyond the fact that a national ID card wouldn't provide any additional security, putting that much private information in one place is just asking for trouble. As this latest debacle shows, and as Schneier points out in the article I referenced.
From the CNN article:
Oh, good. That will surely stop it from happening.THIS WAS NOT AN INSIDE JOB. Two people from different parts of the country were "hacking" Acxiom at the same time, using the same vulnerability. Neither of them even knew each other. Acxiom's security was a flaming turd.
Search all the Daniel Baas articles and you will find he cracked a password file they had in a public directory on the ftp server. This guy did the same thing. Acxiom should be shutdown for their stupidity.
Comment removed based on user account deletion
http://www.acxiom.com/default.aspx?ID=1671&Country _Code=USA
Ya see? Privacy is their TOP concern!!
Trustworthy Computing anyone?
The first "acxiom" of security: "Protect your data"
It was a windows server dumbass. It had a crackable password file on it...ie. SAM file.
Try cracking a Unix or Linux password file with LC!
It wasn't Acxiom employees that agreed to cooperate it was Snipermail employees. Man, people can't get facts straigh.
"Snipermail employees have cut deals and aided federal investigators, prosecutors said.
Also named in the indictment are Levine's brother-in-law Magdiel Castro; longtime business associate Jeffrey Richman, who operates Florida corporation RichMedia Inc.; systems administrator Jeffrey Burstein; Melvin Donald Atkinson, a computer analyst; Marcos Cavalcante, a graphic designer; and William F. Clinton, a computer specialist."
The case will later be overturned when it's discovered that the database was never in fact copyrighted, and his conviction will be dismissed.
Works for these companies? They're probably running Windows. This guy probably didn't even need to "hack in." I've worked in IT since '94 (since I was old enough to work, basically) and I've noticed a resistance by management to go with something that seems so "esoteric" to a non-IT person. That would be Linux, FreeBSD, etc. I mean, obviously we're all techies here, and these news stories probably strike you the same way they strike me. Like DieBold and their MS-Access database. Who the hell... Two things we need to work on:
1. Removing the 'esoteric' nature of open source. Right now it's greek to most people.
2. Become an expert in the Microsoft technologies, and then always recommend against them. (So they take you seriously, since all they know is "MCSE," MCDBA")
3. Routinely discredit your coworkers who know only the Good Word of Microsoft. Also, ask for a decent raise when you routinely save your company thousands of dollars and prevent the headache of MS--Remind them when that big bad Outlook virus hits most of the world. "No sir, we're not affected."
Just my two meandering thoughts...
Investigator: May I acx you a few questions?
Employee: Well... uhh... iom...
I also have a friend to whom this has happened. She tried to get help from the police and the FBI, to no avail. This identity theif is STILL at large, and STILL opens accounts with my friend's social security number, and my friend even has the theif's current living address (or at least the address to which the thief had her new cell phone mailed)....but the authorities will do nothing.
Every other year my friend has to go through the bad-credit repair process...and getting rid of all her old credit cards hasn't helped a bit. But at least she gets plenty of advertisements for products and services she has used before!
either way, that comany makes it easy to do. Useful info on a MS system exposed to the net. Oh yeah.
Some days I wish someone would take my identity.
www.kitchengeek.com -- Nosh for
the cooperating employees are at snipermail,
according to the CNN article.
That said, it's enough (if compressed data) to have the Social Security number of all US Citizens, or all their credit card numbers, etc.
You hear these dumbasses saying it again and again, how important it is to protect personal information, blah, blah, blah. Yet they are reluctant to create laws that protect personal information, as those in Europe.
If the protection of personal information were truly important, data protection laws at the national level would already be in place by now. The reality is that businesses don't feel it's important (unless they get caught in a situation like this one). And they pay lawmakers large sums of money to keep it that way.
People say I'm crazy, I got diamonds on the soles of my shoes...
That's Daniel Baas' conviction. They claimed 5.8 Million in his case in damages.
"Baas faces a maximum penalty of five years in prison, a fine of $250,000 or twice the amount of gain or loss, and three years of supervised release."
This for 1 count. This new guy has a buttload of indictments and will be wishing he got Daniel's penalty.
WASHINGTON (CNN) -- A Florida man was indicted Wednesday in an alleged scheme to steal vast amounts of personal information, and the Justice Department said it might be the largest illegal invasion and theft of personal data to date.
The 144-count indictment against Scott Levine, 45, also includes charges of conspiracy, fraud, money laundering and obstruction of justice, according to the Justice Department.
Levine's alleged target was Acxiom Corp., one of the world's largest companies managing personal, financial and corporate data, federal authorities said.
Levine is accused of stealing vast amounts of personal information from the company via the Internet.
Federal officials said the theft of approximately 8.2 gigabytes of data resulted in losses of more than $7 million.
"The protection of personal information stored on our nation's computer systems is critical to public trust in those networks and to the health of our economy," said Assistant Attorney General Christopher Wray at a news conference in Washington.
"We will aggressively pursue those who steal private information from computer networks and make it clear that there are serious consequences for such crimes," he said.
Levine, a resident of Boca Raton, Florida, is described in the indictment as "the controlling force" in Snipermail.com Inc., a Florida corporation engaged in distributing advertisements via the Internet on behalf of advertisers and brokers.
Acxiom, headquartered in Little Rock and Conway, Arkansas, stores and processes millions of bits of data on behalf of a wide range of clients that include IBM, GE, Microsoft and many major credit card companies.
The invasions from Snipermail were discovered during another investigation of another intrusion at Acxiom last year, authorities said.
The FBI's regional computer forensics laboratory in Dallas, Texas, and computer forensic experts from the FBI and the Secret Service were unleashed on the cyber intruders.
The indictment alleges that Levine and others at the company attempted to hide computers from investigators.
Six employees at the company agreed to cooperate with the investigation, authorities said.
RoseColor red={0, 0xffff, 0x0000, 0x0000};VioletColour blue={0, 0x0000, 0x0000, 0xffff};find / -name *mybase*|chown you
If I compile data on someone, their purchases, habits, income and other records, I'm stalking/spying on them.
If I'm a company compiling 8GB or such data on hundreds of thousands of people, I'm doing market research.
If I'm a single individual who gains access without consent to such a companies data, itself usually obtained without consent, I'm a snooping crook/terrorist/cracker/pervert/thief who gets thrown in jail.
RFID. Credit Cards. Social Security. How come I can't aquire such data, yet amoralistic multinationals can. Does the fact that I don't want such information in the hands of anyone at all even count? Tinfoil hat or no, no-one likes being snooped upon. Data rape is data rape no matter how drunk someone was on free handouts.
May the Maths Be with you!
Mr AC is 100% Informative, this is data freely available to anyone who will pay. Does Slashdot need to report every employee theft story ?
Save a Life. Donate Blood. Please.
Golly! That's 56 MB of data per person! Not only is Big Brother watching, but apparently he's aparently paying closer attention than I am.
"Prepare for the worst - hope for the best."
if you want to get the attourney general to follow through then someone just has to steal his identity. I'm sure that will lead to some nice prossecutions.
Evolution or ID?
...richie - It is a good day to code.
if there are six employees making 8.2 GB of backup tapes/CDs/DVDs/floppies and passing them on for envelopes of cash? Convincing insiders to criminally conspire with you for money doesn't even qualify as social engineering.
This wasn't a "hack". It was an inside job: a contractor using a company-provided username/password to access data that he should not have had access to, but did because of lax policies on the part of the company (Acxiom).
This is not a "hack". It is theft. Plain and simple.
Beside Fully Disclosing when data is lost / compromised, Companies that show they can not protect such data should not have said data. Plain an Simple.. I'm tired of the the fact that companies don't care about security. The would rather say how much they lost so they get the tax write off. -I pour over ever log every day looking for oddities. If companies would spend the time on security things like this could be prevented. and the other fact. How did they get 8.2gb out of the place? Was is disk was it through the Internet. If someone was trying to send that much data out of my office be damned sure i would have caught that. By the way i haven't been infected with a virus in over 4 years. Think that is a coincidence? no it's called proactive defense and if you don't practice it you will get hit eventually.
The only way to keep private data private is to memorize all the info, burn the paper its on, delete is and format the hard drives it was on and always remember to wear your tin foil hat.
Evolution or ID?
Overheard at NASA's image server:
"Houston, we have a problem..."
Weaselmancer
rediculous.
Punch cards!
Fight Spammers!
Comment removed based on user account deletion
Acxiom is a f***ing joke.
They keep their most valuable business assets on a FTP server connected to the public Internet. Privacy sure is their top concern...
Furthermore Acxiom's business IS to ignore people's privacy. They sell YOUR information to whoever pays enough for it.
They also e-pend and allow their customers to spam you.
I hope the next person to hack into Acxiom cracks in real good and deletes not only the data on the FTP site, but all backups as well.
Proletariat of the world, unite to kill Acxiom
In Soviet Russia, I ruled you
"of course i can't be bothered to RTFA, but when will we have laws making it a mandatory requirement for companies like this to fully disclose events like this to the public"
can you be bothered to contact your legislators, or consumersunion.org, or epic.org?
The speculation is on /. seems to be that the weak security is because of M$ products and lazy/ incompetent IT people.
I wonder if that is really to cause, or maybe its because the Company is too cheap to hire good IT, or its too cheap to allow IT to do what it wants? I wonder how often the cause of poor security is not because the IT people don't know what to do, but because the higher-ups will not allow IT to spend the time/ money/ resources necessary. Security does not contribute to profitability, so a company probably does not want to spend on it unless they are forced to.
Just my two cents.
So, the main problem is Microsoft, and, of course, stupid programmers. They mostly use ASP, and now they are slowly migrating to ASP.NET (aspx). Also, there are PHP guys who use include($page) without any filtering, but it's somewhat less common. SQL injection is also less dangerous for PHP+MySQL sites, as MySQL is less "flexible".
Sadly, I don't know what can be done to solve this... Microsoft will continue to exist, and stupid programmers, in most cases, have bugs in their DNA - so education won't help...
...I know it's in Texas, maybe in Tennessee - that says:
... shame on you.
hack me once, shame on
hack me...can't get hacked again!
--g.w. bush
(Ob disc. I have family that works for Axciom.)
The headline isn't right; there is no second break-in. This is a different crowd of people involved in the same breakin that was discussed earlier. The previous arrest was of the guy who actually broke into the FTP server; this is the arrest of a spammer who used that data.
I swear, reading Slashdot is starting to sound like those scrolling news blurbs in Uplink.
Company X reports that N gigs of customer information were stolen by an unidentified hacker.
Company Y reports that N gigs of project data was deleted by an unidentified hacker.
etc., etc., etc.
Oh crap! Data stolen?
::
Wait, only 8.2Gig?
Oh, nevermind then, they can't have gotten the index of my porn collection.
:: wanders off whistling
I assert that my comment is only my opinion, not that of any employer, past, present or future.
the order for six gallons of peanut butter and a latex suit.
Si vis pacem, para bellum! For evil to succeed good men need only do nothing!
I worked at a large public records aggregator company that sold access over the internet and it was shocking how poorly secured the data was (possibly still is). There were many programmers who had copies of the db at home (each db included millions of SSNs, DOBs, etc). I hear they've cracked down and tried to make it more secure, but last time I checked it was still wide open.
Oh ya, and my friend's credit was STILL bad 2 years later from that stuff, even though all parties knew what had happened.
This is because the Fair Isaac credit score has nothing to do with how good a customer you are. It's a measure of how likely a creditor is to make money from you. This is why if you keep paying your loans off after only a few months, you get a bad score. This is also why the reporting agencies were so reluctant to tell people how the score is calculated. If you're an identity theft victim, you're a bad risk for the creditor because they can't be sure you're really you. They're more likely to lose money from whoever is presenting your indentifying information. Works as designed.
This is yet another reason why credit card companies are scams. They're loan sharks, nothing more. Credit card companies in the US need heavy regulation. It will never happen though.
Disconnect your television. Do your own research. Draw your own conclusions. They're probably lying. Don't be a sheep.
The people that cooperating are not from Acxiom. They are from snipermail. This scumbag Scott Levine and his half-brother, Miguel Castro (Jesus, you can't make these names up, truth is stranger than fiction) created a directed marketing "opt-in" scheme to sell email addresses. They hired a sysadmin by the name of William Clinton (ok, now this is getting positively 'Office Space' like. I'm suprised they didn't have Michael Bolton working there as well.) and good 'ol Billy found that Acxiom ran an unsecured FTP site, which you could CD to /etc and get the password file. He grabbed it and ran crack on it. He decoded 40% of the passwords. They started looging in with those usernames & passwords.
They weren't clever enough to grab root and cover their tracks or overwrite logfiles, though. These toads remind me of Chris Cooper in Adaptation. Schemin Florida bums without too much upstairs.
Acxiom hired a security firm to run an audit regarding the PREVIOUS break-in, and the team found that these morons were stealing reams of credit card data with the logins from companies like Microsoft and others. They were then selling the credit card numbers on the black market, mostly overseas.
This whole sordid tale is laid out in the court documents, which are online and make for a great read. This Scott Levine reminds me of Scott Peterson, in sort of that creepy stupid way, where you know he did it just by the smirk on his face.
Anyhow, these guys are going to federal pound-you-in-the-ass prison, and hopefully Bill Clinton will cooperate and get off since I doubt with a name like that, he would fare too well in prison.
As a matter of fact they are doing quite well. I wonder, how such news reflect in the price of company, the earnings of which depend very much on trust and security. Or are the market players so stupid that they do not see the threat. Then, Acxiom is overpriced - go sell!
This is yet another reason why credit card companies are scams. They're loan sharks, nothing more. Credit card companies in the US need heavy regulation. It will never happen though.
Its the tool of choice for keeping Freeloaders poor and the Hardworking rich, which is The American Way. The rub comes when the middle-class tries to use them to finance a better way of life and something goes wrong with their plan --then they get cast into the pile of Freeloaders and have to work themselves into an early grave to get out of it.
As many slashdot readers will be sure to point out, this isn't theft. Like music pulled off Kazaa, Acxiom still has the original data, and their use of it is not diminished by this guy having a copy.
Whenever any of these companies call to verify information, I put them on hold and take care of any possible task that might be more important (which is just about anything). By the time I get back to their call, they've always hung up. Bummer.
Seriously. Offtopic? I tried to load the images thinking that if anyone could handle a Slashdotting, it'd be NASA. But guess what? The page loads, but the images do not. NASA is currently...Slashdotted.
Maybe it's not teh funnae, so by all means don't mod me funny. But it's on topic, especially if you want to see the images rather than read about how great they are. Informative if you agree, and redundant if you're sick of Slashdot jokes, but offtopic doesn't apply.
Remember, this is the problem meta mod is supposed to fix. Mod wisely folks.
Weaselmancer
rediculous.
What will happen when something huge gets compromised? Why don't we have the CHOICE whether or not our data is handled by a bunch of incompetent admins? When I go to the doctor I should be able to assume my records are NOT winding up on a phucking wireless network!
Better idea. If a company gets cracked say three times, then make it the same deal individuals get in our society, most places three felonies, you get a huge jail time, as a career rerecidivist criminal and societal lamer. If a corporation gets busted for malfeasance or gets cracked three times,any combination, then they should get the same, which in their cases would be loss of incorporation priveleges, and to HECK with the stock holders, it's a gamble, they need to have that drilled in daily it appears. Stockholders only appear to be interested in profits as well, there's a large lack of interest in honesty and efficiency with them in general terms. Make these companies lose their corporate charter, stock holders go bust, end of story, maybe correct business decisions will sink in beyond this quarters profits. These people want a capitalist solution, here's one, you aren't guaranteed profits, you are only guranteed a chance to be honest and effective. Not just effective, not just honest, both. either one you fail it, then you fail it. If you are bogus and ineffective, the government, which is supposed to be "we the people", who GRANTS the charters, gets to take them away. There is no automatic guaranteed "right" to incorporation anyplace, it's a privelege granted by the people. This removal of bogus corporations doesn't happen near enough from my POV. Corporations, if you look back in history were granted to both benefit the corporation (and the humans connected to it) as to profits, and also to be of a general public benefit. Unlike the pure lie you see repeated by corporate apologists who keep claiming corporations are "only" for making money. They love to say that, but it's not true, they just wish it was and act like it was, and for too long it has been that way in practice, but it's well past time to go back and revisit the realities of a granted incorporation. If they fail to make a profit they eventually go under,that part still exists with "the market place", but we have lost and forgotten about the other deal, if they fail to be of public benefit. They should be dissolved, and getting hacked multiple times and having innocent peoples data compromised should go right up the responsibility chain to whichever corporation is responsible, along with the humans involved, who should then be prohibited to serve in any official capacity inside a corporation for x-amount of years, a significant long time..
I'd like to see it anyway, get that "responsibile for your actions" deal back into common knowledge and practice.
Last Summer, after the *first* hack job occurred at Acxiom, my wife went to interview as software developer for Acxiom, here in Conway, Arkansas. The job she had at the time was for a local post-secondary-based non-profit organization. At the non-profit, all public servers had telnet *only* installed, and they routinely logged in remotely as root (not that it matters). There was no SSH. Okay, so public servers on a college LAN means?
With that context, what bothered her about her Acxiom interview was the lack of concern about security among her interviewers, and her impression that security at her former job was tighter than at Acxiom! Needless to say, she kept looking. She thought the job at that company was a train wreck waiting to happen. Seems she was right.
What those who want activist courts fear is rule by the people.
When the votes are all in one place, and someone has enough money, your votes are available for purchase because someone, somewhere, is a superuser who can't be trusted.
Part of the problem is that ID theft is the largest growing consumer fraud in the country. Investigators and prosecutors can not keep up with it. ID theft is now 42% of all reported consumer fraud. Over 200,000 people filed complaints with the FTC last year and the FTC estimates that as many as 9.9 million people were victims of ID theft last year. Yikes!
And he's sitting in jail right now. Was an old friend of mine from the local Cincinnati computer scene. It sucks he's sitting in jail right now, but I'm hoping that it will teach companies like Acxiom a lesson. He really didn't even do much hacking, just pulled the passwd file, which was accessible from FTP, big mistake... If anything I hope this encourages Acxiom to take better security precautions. After all they do probably have information about each and every one of us, and our families etc.
Acxiom is certainly not an example of a very good company. Aside from the fact that they were hacked... twice... and had all their data stolen... twice, they are also an unethical marketing company. They purposely ignore opt-out requests from people who want to get out of their lists. In short, their privacy policies suck.
Get out of all of their databases ASAP:
(877) 774-2094
optout@acxiom.com
Portable versions of Firefox, GIMP, LibreOffice, etc
If only the right of the consumer to add hardcore content to movies was recognized... Unfortunately, the act is written in such a way as to only free up censors.
The report of the the registrar of copyrights is interesting, inasmuch as she asserts the existence of moral rights, deploring a recent Supreme Court decision, Dastar Corp. v. Twentieth Century Fox Film Corp., which ruled that the Lanham Act does not prevent the unaccredited copying of an uncopyrighted work.
Comment removed based on user account deletion
At least credit card companies don't break your legs. Between them and the mafia, I would choose to support the cc industry.
Computers are useless. They can only give you answers.
-- Pablo Picasso
I'm going to opt-out from all of the databases I can think of. With any luck, they'll honor the request. You can start by sending an opt-out request to optoutUS@acxiom.com. (Hopefully they won't spam me). Next up: The Direct Marketers' Association.
Comment removed based on user account deletion
Comment removed based on user account deletion
Wouldn't the sheer size of dats stolen indicate it was an inside job? 8.2GB doesn't just get downloaded off the server through the internet.
the Feds should go all out after identity thieves..
oh wait, that would help the people of America and not the corporations...
--- Grow a pair, liberals... stop letting the Republicans bully you!
You say they ignore requests to opt-out but yet encourage people to opt-out.
Swiftian in its alacrity.
...CHICKEN? Sure, it's easy to hide your identity when you take a swipe at someone, but it take balls to call me stupid to my face when I can see yours.
Piker.
I notice you don't have any constructive comments for what could be done to secure the data.
Weren't you tipped off that something might be wrong when your tin-foil hat anti-corperation post on the NASA thread also got modded as offtopic ? =)
--LordPixie
...They purposely ignore opt-out requests from people...
...
:)
Get out of all of their databases ASAP:
(877) 774-2094
optout@acxiom.com
UHhh... If they ignore opt-outs... why are you trying to have us opt-out?
Just seeing if you can keep us busy?
---- It puts the lotion on its skin or else it gets the hose again. It does this whenever it's told.
A number of people have posted comments suggesting that (PTP) the root of the problem here was Acxiom's shoddy security. And have then followed up by posting open-ended questions about "how can we secure the 'Net when bozos like these guys don't lock their doors?"
There's a simple solution.
And no, it does not involve jail time for dumb sysadmins (stupidity is not a crime). It is much simpler--it's called tort law. If you are injured by Acxiom's shoddy security practices, you have a legal claim against the parties responsible for your injury. So, for example, suppose that your credit card information was swiped--and it transpires that the data came from an Acxiom-maintained database of information from General Electric. You can sue both General Electric and Acxiom, claiming a financial loss, damage to your reputation, economic losses due to your now-shredded credit rating, etc.
Suing by yourself might be an exercise in frustration--but here's where contingent-fee litigation ("you only pay if we collect") works for the little guy: convince an attorney to pursue this as a class-action suit, and companies like General Electric will pay significant money to get out of the suit.
The result?
No--you're not going to get rich. You're probably not likely to get much beyond the actual cash loss you can prove. But you will dramatically raise the cost of outsourcing database maintenance to companies like Acxiom. And that's the only realistic way, IMHO, to solve this problem. Big companies have to learn that outsourcing the IT problem to the lowest bidder includes a substantial amount of risk--which, sooner or later, will cost them cash.
What is happening to the morons who leave this kind of information sitting around on an easily cracked server? Are they getting fines? Jail time? 40 lashes with a wet noodle? What?
Because if not, dammit, I want to know where the torrent is!
Libertarianism is rich wolves and poor sheep playing gambler's ruin for dinner.
Get a Report
From the Consumer Hotline Menu you may request a report showing what "non-public* (see data category 3 below) information that Acxiom has on file about you". This is option 6 from their Consumer Hotline Menu.
You will be asked to leave your name, address and phone number so that they may mail you an official form to request the report of the non-public information that Acxiom has on file about you. There will be a $5.00 fee for the report. (Press # at the end of the message, then # again to send the voice mail message.)
Opt Out
To 'Opt out' of having the information that they store about you sold to marketing companies, select option 5 from the Consumer Hotline Menu. You will asked to leave your name, address and phone number in order to be sent a form to request the opt out. There does not appear to be a fee. (Press # at the end of the message, then # again to send the voice mail message.)
Acxiom's Data Classification
Acxiom classifies consumer data into 4 categories: (this info came from option 2 on their Consumer Hotline Menu.)
Examples may include: property records, birth, death and marriage records, professional membership records.
Acxiom may own this type of information about you.
This is information that is collected about you at the time that you make a purchase.
Examples may include: name, address, phone number, etc.
Acxiom may own this type of information about you.
This is information that is collected about you from information that you submit for surveys, etc.
Examples may include: name, address, phone number, and any other information that you submit to a survey.
This is apparently the information that will be reported to you if you request the $5.00 report about what they know about you. As far as I can tell, this is the only category of information that will be reported to you, but I don't know for sure.
Acxiom may own this type of information about you.
Examples may include: info from your credit report, data about medial records, data about your salary or employment history.Acxiom states that this information is regulated under the Fair Credit Report act and that "Acxiom DOES NOT OWN ANY INFORMATION IN THIS CATEGORY". (my capitalization).
I don't know if this means that they don't store any of this information, period, or if they are just weaseling out by saying that they don't 'own' it, but not saying if they store it for their own use or for their customers.
Disclaimer: This is information that I gleaned from listening to the information available on their voice mail consumer hotline, (1.888.322.9466, option 5), and I may have misunderstood it and/or be misrepresenting it. Please do not take this as the last word on this subject.
And as you tread the halls of sanity, You feel so glad to be, Unable to go beyond. I have a message, From another time..
I mentioned this to a friend of mine that works at Acxiom, and he told me if I had read the article completely (RTFAC?), I would have realized this incident happened last year, and the only news is that they want to press charges against the people involved now that the Justice Department has completed the investigation. There have not been any new break-ins, he says, and the company has beefed up security since then.
--Mythos
I just started working for a company that gets lots of marketing data from Axciom... (it's a financial institution)... I had never heard of them until a few weeks ago when I started my job here...
Any word on snipermail.com and any charges it may face if this guy is convicted? The article doesn't say jack about it.. any lawyer-ish folks out there have input?
http://www.babysmasher.com
http://www.openingbands.com
Some ambitious politician would make lots of points for passing a law resembling the FDIC (Federal Depositors Insurance Corporation) for personal information "memory banks". That would include audits for eligibility, including corporate insurance, ultimately backed by the federal or state government. These banks which lose info are bad for the economy, as inhibitions on eCommerce spread, as well as bad for the people personally affected. Government certification and underwriting would educate the consumers as well as protect the info. Until then, these memory banks have no strength for demands to disclose personal identity info.
--
make install -not war
Not that I disagree with your larger point, but this:
"had all their data stolen"
is no where close. 82 gig was stolen. That's peanuts. Acxiom has more data than God.
Most state REQUIRE that you have an ID card.
A driver license will do, but if you don't have a driver license you must get an ID card.
The Kruger Dunning explains most post on
don't forget, even applying for a loan, or getting a credit check lowers your rating.
The Kruger Dunning explains most post on
You say they ignore requests to opt-out but yet encourage people to opt-out.
Good point. How about: They ignore opt out requests from a large group of people that doesn't want to receive ANYTHING like this, forcing them to all opt-out individually, just to make it more difficult to remove yourself from the list.
Portable versions of Firefox, GIMP, LibreOffice, etc
Anyone who tells you a public company's TOP concern isn't the stock pricec is LYING, pure and simple.
I have worked at Acxiom for many years. I just about busted a gut recently when I read an internal memo, after 5% of the workforce had unceremoniously been fired, that included the winning line to the effect of "you are our most valuable resource". Like hell I say; actions speak louder than words, and we're all deaf by now.
Since the FTP-server break-ins data security has been much better, so it is in fact a large concern, but only in as much as it affects the stock price. If the hacks had not been publicised and large customers threatened to pull their business, nothing would have changed.
...And you're a very bad person
Not that I buy all the FUD over terrorism. Mostly it's a load of nonsense. But how come the government has time to try to ban cell phone use, access to cell phone outages information, and other relatively obscure pointless data, but doesn't act when information that could assist with identity theft is stolen?
WTF?
Who the hell is prioritizing this crap?
Three years ago, my identity was stolen and the thief applied on-line for a credit card in my name. When the credit card company double-checked the application by calling me, he/she was blocked. With the help of the card people,I then did some investigating of my own.
... and called Chicago police ... my suburban police ... the FBI ... and the Treasury. In the end, I found out that the Treasury had jurisdiction ... and may still.
... even though I could tell them where and who to call.
... we had a street address where the card was to be delivered ... I was an officer of a local bank at the time ... and ... I offered to assist in an investigation by calling the sysadmin or the local company president. No one at local or federal level was remotely interested. (The conversation with the FBI was almost comic ... the agent was handing me xeroxed copies of newspaper articles on how to prevent identity theft while I was trying to hand him the crook. He saw it all as my responsibility.)
The thief had submitted an e-mail address using my name. He got this e-mail address from a local company. So, using whois I got the name of the president and the sysadmin
NO ONE was interested in pursuing the case. Because the theft was "only" for $5,000 it was below the prosecution limits set by the Illinois Attorney General's Office. And a kindly Treasury officer explained that they followed local guidelines and would not be prosecuting
Note: we essentially HAD the criminal
BTW -- the thief was using my AMEX credit card numbner to apply for "his" new card. Dumpster diving for card numbers at merchant locations is quite common in metro areas like Chicago.
Um... make sure you read the press release again. It was only 8.2 gigs.... (and the data was encrypted)
Getting a credit check can lower your rating temporarily if the institution making the check says you're applying for credit (rather than, say, applying for a job or rental). If you're applying for a whole bunch of credit cards or loans at the same time, that suggests you may be trying to borrow rather more than you can afford (or at least than the banks think you can afford).