Slashdot Mirror
AT&T Crack Part of a Phishing Operation
JohnGrahamCumming writes "According to a story in the San Francisco Chronicle the AT&T store crack was the prelude to a very sophisticated phishing operation. The phishers were aiming to use the information from the store to fool existing customers into divulging SSNs and other personal information." From the article: "'The information that was provided by customers who ordered DSL-related equipment included name, address, e-mail address, phone number, credit card number and credit card expiration,' the memo says, adding that the hacked data didn't include Social Security numbers or birth dates. But the hackers had a scheme to get this extra info. After accessing the customer data, they incorporated it into phishing messages that were promptly sent to AT&T's DSL customers ... Each message included a legitimate order number culled from the AT&T vendor's database to create an illusion of authenticity. Messages also included the recipient's home address and the last four digits of his or her credit card number. "
This is just one of many, many issues of privacy violations that have happened in the last year. And the feds seem mainly interested in letting states regulate and report on security breaches. So far only a few states have legislation to notify consumers of database compromises, which is a shame. The sad part is many people may have had their information stolen and they will never know until the information has been exploited, all the while the corporations have been aware of this for a long time and choose not to reveal the violations in fear of a negative PR.
You (should) still be immune to phishing scams if you refuse to give _any_ personal information out unless _you_ initiated the contact (and then only with known-good contact info for a business, such as calling a number printed on your phone bill). If you get an email like this, _call the company._ Yes, I know that it's usually impossible to get through, but even if you can't or don't, nothing bad will happen.
I wish we could get more people to realize this.
This is bad, I believe I am an affected customer. This morning I had random charges on the credit card that I used to pay my AT&T bill with. Although it is a little relief that the report says that they did not take any social security numbers (which I do not believe I gave it to them anyways), I hope there is something I can do to keep myself proactive in protecting my identity. Anyone have any suggestions (other can canceling my CC#, which has already happened)?
Also, for anyone else, follow in my footsteps: DO NOT GIVE THE PHONE CALLERS ANY PERSONAL INFORMATION. PERIOD. If there is an issue, call your bank number personally on a known verified phone number and have the clerk verify ALL NAMES AND NUMBERS AND REASONS. (I've gotten calls already with people asking for my account information this morning as well from unverified numbers. Its happening).
An SSN number is needed for a credit check. Therefore any company, like AT&T, that does end-of-the month billing will run a credit check on all of their customers. From their perspective they are giving one month of credit every month.
The solution is to ban the use of SSN for credit files. Use a number that the consumer controls.
Also, let customers pre-pay monthly. I know how much my monthly cell phone billing is going to be, let me pre-pay and avoid the forced use of credit (which gets reported to the credit agencies).
I go to school at Metro State College of Denver. About a year ago, a laptop got stolen that had much the same kinds of information in it on well over 50,000 students who had attended the college over several years.
My mother works for Wells Fargo Home Mortgage; an independent company that was auditing their health insurance had one of their laptops stolen with similar information for thousands of WFHM employees (possibly other Wells Fargo employees too).
Here's the bottom line: Expect every person in the world to try and get at your life in anyway they can. That said, it's your job to protect yourself. Inconvenience, lack of technical knowhow, lack of time and etc. are not valid excuses; it's just too damn important. If someone nabbed Newegg.com's database right now, how many of you would be in great risk? Particularly if your record was the only one they stole; a Newegg.com employee could probably do that without Slashdot or ABC News ever knowing about it.
If they got the card number you use at Newegg, how much money could they take? Is that a check card linked with your bank account? Your only bank account? Most credit card companies will immediately call you if there's all of a sudden a much greater than usual balance on your card. Banks won't call you of a large sum of money disappears out of your account.
So, is most of your money in a savings account that NOBODY has the information for (except you)? Is your home address well secured? Do your kids know how not to get kidnapped? You do check your own credit semi-frequently, don't you? Does (whatever company) really need your SSN to sell you their product? Do you think their system will blow up if that field is left blank when you throw a fit? Do you refuse to send sensitive information over e-mail or IM or SMS (with a preference for telphone or in-person business)?
Does your garage door opener hang proudly from your sun visor (with the corresponding home address on your registration & insurance in the unlocked glovebox)? Is a key to your house sitting in a Supra lockbox hanging on the door handle so the maid can get in? Or is it, perhaps, in that fake looking rock next to the porch? You know, the one your kid picks up every day when he gets home from school?
Think. It's your job, not your government's, not the sheriff's, and not some corporation's... yours. There may be laws in place to protect you; people will break them. And then you're still out your valuables. Really: think.
Yeah, right, never give out your SSN.
When I was in the emergency room with chest pain and they handed me a form, with a place for my SSN on it, and I asked if I had to give it, and they said "you won't be seen until you fill it out," what would you have done? Argued with them? Called a lawyer? Whipped out a copy of the law that says they can't do this? Asked them to get an ambulance to take me to another ER? Raise the ante and see whether they were bluffing? No, I did what I thought would affect my blood pressure least, and get me seen soonest, which was... to cave in. I gave it to them, and I believe anyone with any sense would have done the same thing. Worry about it later. I had more important things to worry about.
And I think I'm _reasonably_ assertive about such things. Back Massachusetts drivers' licenses had SSN's by default, I was one of the people who always asked for and got a different number. When the Red Cross wanted my SSN for blood donations, I said I wouldn't give it to them and they issued me a donor card with a non-SSN.
When my company's medical insurance wanted my SSN, I said I wouldn't provide it. They said fine, but we won't insure you. So I called the Social Security office, and said "do I have to give it to them?" And their answer, practically verbatim, was, "No, you certainly don't. However, they are under no obligation to provide you with insurance unless you do."
Whenever I'm asked for my SSN, I always ask if there's an alternative. (And wait while they check with their supervisor). I succeed maybe half the time. The other half, well, I usually cave.
If you can get along without credit cards, auto loans, medical insurance, and emergency rooms, more power to you.
That line on every social security card that says "Not For Identification Purposes" is a lie, plain and simple.
"How to Do Nothing," kids activities, back in print!