Slashdot Mirror
Consumers Data Stolen from LexisNexis
LE UI Guy writes "Reuters is currently running a story regarding LexisNexis being tapped into by identity thieves who accessed up to 32,000 customer profiles. Information hit included names, addresses, Social Security and driver's license numbers. This comes on the heels of rival ChoicePoint being breached for 145,000 profiles last month in a similar case. Better check yourself." Update: 03/10 02:40 GMT by J : ChoicePoint's name corrected (and, it may be more than 145,000, they don't know).
Anyone got a torrent of it?
I am sure glad I don't drive a lexus.
Jesus! I've seen this mistake on the national news and now on slashdot. I thought the geeks would realize there is a difference.
Let me make it clear, CheckPoint makes security software, rfid badges and firewalls. They are not the ones who sell all of your information to credit card companies. CheckPoint has no info that you didn't give them. ChoicePoint is the one that fucked up!!!
Can I get an eye poke?
Dog House Forum
Make the CEO, CTO and Customer Support manager provide their own personal information in their own databases.
This comes on the heals of rival Check Point being breached for 145,000 profiles last month in a similar case. Better check yourself.
Can someone post the list?
Checkpoint ( www.checkpoint.com ) makes firewall software. THEY HAD NO CUSTOMER INFROMATION STOLEN. please update the story and make sure the facts are correct - its pretty freaking rude to say a company lost data, especially an innocent company.
Choicepoint lost the data. not Checkpoint.
Here come the lawyers!!!
Visualize Whirled P.'s
Check yourself? What does that mean? Check that you haven't been stolen? What if you haven't - what can you do to stop it from happening after you check?
These corporations are destroying the value of our essential property: our identities. They demand we give our personal info, without enforcing our copyrights to prevent its being disseminated, then let it get stolen by people who will use it to damage us. When someone rips me off with some personal info they stole from some negligent data warehouse, the warehouse should be liable for my damages, including the work to recover my losses, and the defamation that will inevitably ripple through the endlessly interlinked online infosystems forever. And when compromised, they should pay my identity theft insurance premiums. This free value we deliver to them has a cost when it's abused, and such insecurity abuse is now obviously standard practice.
--
make install -not war
With phishing, spyware, database theft... people picking thru your trash...
How long before ANYONE'S identity has not been stolen?
Seriously.
Why not just put a fraud alert on everyone's credit reports and let's get it over with. You want to apply for credit? You'll have to jump through a few more hoops...
The system as it is now is painfully broken.
are the worse at security on everything? Not just the OS, but everything about it. They spend 5x as much money and STILL they do not get it right.
How long it will take someone to build a complete (may be 90%)databese of all americans thet will include SSN, DL#, Home address & Phone # etc. If this is the rate of privacy the thefts.
How much it will be worth it and to whome it will worth it.
Looks like Windows 2000/NT servers.
Unpatched ?
It can't be theft if the data is still there, right?
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
I am a man, not a number!
Signed, #6
http://www.washingtonpost.com/wp-dyn/articles/A19
Most organizations have some sort of regulatory body. Does the data harvesting industry have this?
Perhaps this should turn some heads in Congress now that we've got multiple cases of this insecurity. The question is, is Congress going to be able to do anything about it or will it be the same situation as with government computer security: Right now they just say "your security is bad" but that doesn't always fix the problem.
I know only the name of my phone company, for example, but I have no clue who they contract with for data processing or billing or marketing. How can we ever really find out if a security problem at one company affects us? These back-end companies are generally companies that serve niche markets and practically no one has heard of them.
-- Microsoft is the most expensive commodity operating system and office suite vendor in the marketplace.
Did anybody else think -- what the hell is LexisNexis doing with peoples' Social Security numbers? But it turns out that this is a subsidiary that gathers up consumer data. So it's not that you have to key in your SSN before doing a Lexis search these days.
Though I'm sure Ashcroft^H^H^H^H^H Gonzales would like that idea...
four nine eighteen twenty-7 thirty-nine forty-7 fiftyeight sixty-nine seventy-9 eighty-8 one-hundred-and-nine one-twenty
I don't want a bunch of strangers reading my dossiers (and I have had exactly this - I was affected by the ChoicePoint scam). If I had to approve every offering or sale of my data, I would have easily been able to block said scam.
sulli
RTFJ.
Our data should only live for the time it takes to make an online transaction; and not a femto-second longer.
I want a "Mission Impossible" ID that self-destructs!
How hard would this be to imple%$^? pfffttt __end_smoke_fx;
What kind of comeback do people have if their data is misused as a result of this? I know in the UK the Data Protection Act would cover this kind of thing, but are there powers in the US to prosecute LexusNexus should their failure to protect your data cause you loss?
It was information on 32,000 (anybody want to bet it was 32,768?) members of the public, not customers. To bad, in a way -- Lexis is used most by lawyers, judges, congresspeople and so on -- had the Lexis customer data been hacked and say all the judges on the 5th Circuit or the Ohio congressional delegation had their identities stolen as a result, you'd probably see reform a whole lot faster.
I'm not sure how the two are really comparable as rivals. LexisNexis (along with their rival in the legal profession, http://www.westlaw.com/ ) Provide excellent (as well as very expensive with searches running at over $70 per minute) coverage of court cases, codes, laws, public records, etc, which are all immensely helpful to legal types. Sure they have public records containing some personal information, but very little that isn't already available as public information (so things such as deeds, criminal records, voter registrations, etc), and it's definately not their primary focus in life.
Sysadmins? Screw that, most of this shit happens with social engineering.
This is getting to be like the Enron/WorldCom type of scandal. Company X coughs up a few thousand files, Company Y coughs up a couple hundred thousand files, Company Z has the fucking barn door wide open and the theives have a battered pickup truck parked on the lawn and they're so damn surprised that it takes place.
So... where's the law that can be leveraged, saying these companies are responsible for keeping this information under lock and key, to hit them with the civil suits they so richly deserve for their laxis maxis business controls?
A feeling of having made the same mistake before: Deja Foobar
DSW's parent company, Retail Ventures, just issued the warning that thieves may have stolen credit card information for thousands of customers by hacking into the company's corporate database.
It only affects credit card customers who used their cards the past three months at more than 100 stores nationwide. There are at least eight locations in North Texas.
http://www.msnbc.msn.com/id/7137966/
oops.. http://www.turbulence.org/Works/swipe/request.html
They're flippin' evil. I'm sure I'm not the only one out there who's revolted by the fact that private corporations are the only effective sources of legal (read: public domain) data and other such public information. Shouldn't the government offer a LexisNexis-type service for free?
From the Wikipedia entry on Lexis-Nexis; all emphasis mine:
"LexisNexis is a popular searchable archive of content from newspapers, magazines, legal documents and other printed sources. Primary customers are lawyers and journalists.
Besides all current statutes, Lexis contains nearly all published case opinions in the United States back to the 1770s, and all unpublished (but publicly available) case opinions from 1980 onward. It also has full libraries of statutes and case opinions for many other common law jurisdictions like Australia and the United Kingdom.
News stories from the majority of English-language periodicals worldwide are available back to 1986, and there are a few articles available as far back as 1980.
Lexis has a library of public records, which includes current mailing addresses for nearly every living person in the United States. It has real property deeds and mortgages for most states.
A fee is charged for using the service. The fee was formerly hourly (at $300/hour or higher) but LexisNexis now prefers to negotiate monthly flat fees based on the user's ability to pay."
("Based on the user's ability to pay"? I wonder how they'd respond if I said "I barely can afford to pay my bills, much less offer you money for access to public domain data...")
With spending like this, exactly what are "conservatives" conserving?
I'm changing my name to Holden McGroin. Let's see you try using that name in your ripoffs!
Strange women lying in ponds distributing swords is no basis for a system of government.
Very definitely. You need to immediately report to the Credit Correct Center nearest you. Please advise a family member to pick up the ashes in 9-10 business days.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Recent events have forced me to examine and then re-examine my security arrangements. I'm the new admin for a small publishing concern and I'm playing catch up right now. Before I got hired, a lot of admin work was left undone. So I want to do a good job, and all this talk of data theft has me spooked...
I've inherited a mess. A total mess. Employees with default passwords (that never expire,) vendors from years long gone by with active accounts, some used recently... (Yeah, I've already disabled them.) The list just goes on.
My point is, when you read a story like this you feel bad for how screwed the admin(s) will be (especially if they have family) for a moment.
And then you get to work and double-check that you're not next in line for a public de-pantsing.
Tough day? How about a free Mac mini?
In this Homeland paranoia age where everything that is in the database must be right, you certainly don't want to see government ID numbers getting used in fraud. How do you go about getting a new Social Security number when the existing one is being used in fraud?
...people willingly give away their personal property, their data, their "IP", then these other companies own it. If people just insisted that THEIR data was THEIR property and took care of it with that sort of mindset backed op with some rational laws, then this wouldn't happen, and these companies with the data warehouses wouldn't even exist like they do now.
.0001% people ever even tried one time to keep their data to themselves and to insist to government that this should be so. They never gave a care, to busy with entertainments or whatever to even lift a phone to make a call to a congress critter, or to say NO to some company "asking" for data they don't need really for a business transaction. Mass conditioning that it's socially cool to get ripped off. Shazzam, the world is full of thieves, maybe more people will stop and think about who they give their property to and why they give it away for what purposes now. Maybe it's a better idea to just retain ownership? One law would do it, too, your data is yours, it shouldn't be necessary to transfer ownership of your data just to do business someplace.
Most people don't think that way, but people who start corporations DO think that way, they recognize valuable property when they see it, and make billions off of millions of people voluntarily giving away their property to them.
If it wasn't stolen from you directly, it's sure not your property anymore. If you donate your old TV to the thriftstore and they get broken into and that TV is stolen, well, "your" TV didn't get stolen, their TV got stolen. If you want to own and keep possession of your TV, well, don't give it away in the first place then. Simple concept, just apply it to your data. It's similar enough for conversational purposes anyway. "IP" ownership is bigtime in business, there's zero reason everyone's personal data "IP" shouldn't be theirs in total.
So people can't really say "their" stuff got stolen, some big companies stuff got stolen, they gave up their rights to full and complete ownership a long time ago. they already got "social engineered" out of ownership, just they don't realise it, or just don't care enough to think it through. Now that same data property down the pike got social engineered again, oh well, guess the original owner didn't care enough to hang on to it.
but, but..we can't live in society without giving our property away! Yep, that's the point, much less than
yea, how? Just because it's running IIS 5 doesn't mean it has 14 holes automatically. I would imagine it's either A. Unpatched or B. Holes in LexusNexus software. C. Social engineering.
However, I don't think the comparison with giving away a TV is accurate. One's name, address, phone number, social security number, drivers license number, etc., are attributes that are retained by the one who owns them. This information is simply provided under various circumstances. The fallacy here is that businesses and other entities have taken it upon themselves to decide that the mere act of provision extols upon them a right of ownership. While there are not yet any laws that clarify this, I maintain that it does not, Be that as it may, people must be proactive about how this information is used. Insist that it not be used for anything but the transaction at hand.