LexisNexis Breach Worse Than Believed

Rollie Hawk writes "Worldwide law and news sifter LexisNexis has some bad news of its own this time. Actually, "bad" might sharply understate the situation. More than a month after disclosing information on a database breach that led to 32,000 customer IDs being stolen, the results of an internal review showed that in fact the damage was nearly ten times worse than previously thought. LexisNexis is already "offering free support services, including credit bureau reports, credit monitoring for one year and fraud insurance" to the nearly 300,000 additional victims it will soon be contacting, according to a Reed Elsevier statement to the Regulatory News Service. So far, no identity thefts have been reported by earlier victims, at least some of whom had private information such as addresses and Social Security numbers unwittingly divulged."

Comments

Social Engineering

[TripMaster Monkey]

From the article:

The thieves, who obtained information including addresses and Social Security numbers, did not hack into the computer system. Instead, they were able to fool the company into giving out password information, CNN reported.

Your network's security is inversely proportional to your users' gullibility.

Why?

[i.r.id10t]

Why on earth would lexisnexis (or any other site providing a service) need a customer's SSN? Ok, some tax sites I can understand if you are electronically filing, but for anything else?

Of course it hasn't been used yet.

[Qzukk]

You'd have to be stupid to pull something like this then rush out and use the information you just got.

Wait 8-9 years, then we'll see whose identity information is being misused when this incident is just a distant memory and people are scratching their heads over how their information "got away".