Slashdot Mirror
Experian Breached, 15 Million T-Mobile Customer's Data Exposed
New submitter Yuuki! writes: The Washington Post reports that T-Mobile's Credit Partner, Experian, has been breached revealing names, addresses, Social Security numbers, birth dates and driver's license and passport numbers for any customer who has applied for device financing or even services from T-Mobile which required a credit check. Both parties were quick to point out that no no credit card or banking data was stolen as part of the attack. The attack started back in September 2013 and was only just discovered on September 16, 2015. Both Experian and T-Mobile have posted statements on their websites and Experian is offering credit for two free years of identity resolution services and credit monitoring in the wake of the breach.
Two free years of credit monitoring after the bad guys had two free years of access! Great work, Experian!
Thank God my Credit Card numbers weren't breached, because those are impossible to cancel and replace. I'm so thankful it was only my Passport number, Driver's License number, social security number, full legal name, birth date, and address that were stolen, because those are a snap to cancel and replace.
They need to make more reparations than that, as actual remedy, compensation and punitive damages with a positive, non govt funding goal.
In corporatese, "I'm sorry" are empty words with no meaning without restitution and money.
As an identity theft victim, let me say that "no credit card or banking data was stolen" means nothing. With name, address, SSN, and birth date compromised (as well as driver's license and passport numbers), anyone can now open new lines of credit in the names of any of the 15 million people whose information was accessed. And the two years of "credit monitoring" will do almost nothing. Fraud alerts won't either - those are voluntary.
My recommendation if you are one of the 15 million people is to freeze your credit. This will stop ANYONE from opening a new line of credit under your name unless you first thaw your credit file. It's a royal pain in the rear when you need to do things like refinance a loan, but it's better than having a collections agency banging down your door because you owe $5,000 on a credit card that "you" opened.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
...there won't even be the same sort of mass outrage associated with this. Only a few geeks will even notice or pay attention. Making it even less likely that anything will change.
A Pirate and a Puritan look the same on a balance sheet.
The apostrophe should go after the 's'.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
One of the three major credit rating services? I'm a little bit impressed that this breach was limited to only everyone who has ever applied for T-Mobile service.
Guess what they're not giving you? Your actual credit report. You just get the abbreviated version, so you can't actually look it over and see if this generally corrupt industry is fucking you. They will, however, sell you your credit report at a special members-only price. So what's happened here basically is that Experian is getting free advertising and T-Mobile is going to get off without punishment.
Fuck you Experian, and fuck you T-Mobile.
I already said fuck T-Mobile since they cancelled the PAYG plans I've been using, but fuck them twice now.
Are there ANY US mobile providers from whom I can buy a PAYG SIM which are not total fucks?
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
One of the best things that can be done to prevent data breaches is require that data be deleted after a certain time. I don't see a good reason why 15 million customers should have their data retained after the credit check is complete. It won't stop breaches, but it would limit their scope. There also needs to be severe penalties for negligent security or failing to notify customers in a timely manner. Better yet, eliminate social security numbers for identification altogether outside of social security and (maybe) tax purposes. And it's no surprise that a credit bureau was attacked. They're gold mines of information waiting to be compromised. I'd like to see particularly strong regulation of these companies. Consumers don't really get to opt in, but this personal information is stored and can be compromised easily. That doesn't seem fair at all to me.
seems every year the thing to do is open a T-Mo account, "buy" an iphone and resell it before it's bricked for not paying the bill
...there won't even be the same sort of mass outrage associated with this. Only a few geeks will even notice or pay attention. Making it even less likely that anything will change.
Quite right. Even now (as millions of hard-earned credit ratings are threatened) the school shooting, the Vatican's elaboration on the Pope meeting Ms. Davis, and latest thing Trump said are bigger news stories.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
Go to all 3 reporting agencies and lock them down. It only takes a little time per agency and will save you years of headaches later. If you need to apply for credit unlocking is just as easy. You can choose a time frame or a specific company to allow through.
Experian is offer a two year free credit monitoring in connection with the breach of their system. In order to sign up for the two year credit monitoring they require you to provide your full identity; SS number, birth date, etc. Isn't that just the information that was just compromised in their system??? How do they think they can be trusted??? This does not resolve the problem of their lack of network security with sensitive information.
It is high time the abuse of the Social Security Number ended. SSNs should be used for one thing: Social Security. Using a single "secret number" is an archaic system that for increasing numbers of people is no longer secret. Let's not forget all your other details which are used to identify you but aren't really that secret (your full name, your birthday, etc).
This information is used for identifying a person or proving identity so it's an authentication problem. We can do better! We have public key encryption. The government issues you a key pair (say, embedded into a photo ID, which we all have already) and now you can prove your identity without giving someone an irrevocable secret.
Authentication is also two factor: You have an ID and you know a PIN (or passphrase). If you lose your card, then your identity is not immediately compromised because it is protected by your PIN. This gives you time to have the gov't revoke your old key pair and issue you a new one.
In the case of the credit bureaus (I think we can all safely assume credit isn't going away any time soon), they associate your credit history with your public key and nothing else. If the key is revoked (by the gov't), then they move your file to the new key. No one can take out credit using the old key. In fact, any attempt could be reported to law enforcement.
The entire US Department of Defense has been using a system like this for years now and has by and large done away with things like passwords and hand signatures, especially for the things that matter most.
Is this completely foolproof to prevent someone impersonating you? No, but it is much better than having your SSN and other PII out on some forum where just anyone can use it for nefarious purposes and would be well worth its cost and complexity. The greatest obstacle is the credit bureaus having nothing to gain in actually protecting their "customers'" data because then to whom will they sell credit monitoring?
Fascism should more properly be called corporatism because it is the merger of state and corporate power. -- Mussolini
All told, I have 17,300 years of credit monitoring due to various corporate negligence.
There's no way they're going to steal my identity again!
"15 million". Huge number. It usually takes the power of the US Federal Government to screw up this big.
But one thing is not clear from TFA, let alone from the slightly misleading TFS.
This is an Experian hack, not a T-Mobile hack. What makes any "expert" think the exposure is limited to someone who interacted with T-Mobile? Experian is one of the awful ubiquitous unavoidable facts of life, much like the Government (see above). If you have participated in any non-cash financial transaction, they probably have a file on you.
What are the particulars of this breach that make it strictly an "Experian interacting with T-Mobile" risk? Experian is huge, and if you're counting on some kind of strict internal data partitioning within the company to restrict the attack area to "T-Mobile applicants" you're too naive to sit with the grown-ups.
Seriously. Why the fuck isn't this a maximal-sized no-holds-barred every-file-Experian-holds breach?
Welcome to the Panopticon. Used to be a prison, now it's your home.
Good news everyone! The bad guys only got things like your SSN, which can never be changed and which will haunt you forever, but not the credit card numbers which can easily be replaced and you probably wouldn't be liable for any illicit charges on, anyway.
Gamingmuseum.com: Give your 3D accelerator a rest.
These breaches are a good thing, because they are forcing evolution.
Something we in IT have always known, is that security cannot be solely applied through obscurity. There will always be opportunity, tools and motivation that expose it.
This has never translated into other information sensitive disciplines, and right at this moment we have a tremendous amount of fragility in our financial and personal identification infrastructures because there is no concept of authentication.
That has to change. More of these breaches, which are not in and of themselves exceptions but rather the rule, will raise awareness to the reality of the situation - that attempting to protect oneself by hoping that ever more widely distributed sensitive information isn't disclosed, is not feasible.
"No good deed goes unpunished"
"numbering services not available for that area"
whatever the shit that means
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I went to the Tmobile site and what happened?
I got a popup saying "T-Mobile wants to know your location"
How fucking ironic.
-Styopa
It seems to me if it's been going on for 2 years, Experian hasn't been doing the job to secure our data. They should be facing some criminal charges or fines over this. Better yet; they should shut down. This is very gross incompetence. What's the two years going to do? "Oh, someone is using your data. LOL. Sorry." That's pretty much all they're going to do. They're not going to help solve a problem they are responsible for. They need to be held responsible; by someone. 2 days I could understand; 2 years is just plain incompetence.
Geez, the Magenta Mafia downmodding is harsh... But I stand by it, because as we know, Real Men (TM) use Sprint, just to prove they can suffer like Sisyphus and by God take it like men.
Pretending this is my office full of bitter coworkers..
I can at least understand the shooting becoming the top story for a while (if it bleeds it leads), but it's obvious how far the news media has fallen when "the Pope is Catholic" is headline news.
Socialism: a lie told by totalitarians and believed by fools.
The Washington Post reports that T-Mobile's Credit Partner, Experian, has been breached revealing names, addresses, Social Security numbers, birth dates, driver's license and passport numbers
Both parties were quick to point out that no no credit card or banking data was stolen as part of the attack
Great, so the banking and credit card data--which would only lead to fraud for which the individual would not be held accountable--wasn't stolen. But all the most valuable data for applying for fake credit and identity theft was! Much harder to fight off fake accounts then fake charges on a valid account.
This should go beyond just two years of free monitoring... what do I do when someone is out there impersonating me? Hope I have an alibi when they come looking for mr, but that's sort of tough to do when you're a basement dwelling hermit...
Experian partitioned clients apart from one another. The breach hit their T-Mobile systems, which is why they are mentioning it only affects T-Mobile customers. But, you are right not to trust Experian, if it happened to one of their systems it could be happening as we speak to any other of their clients. It could also be happening to any of the other credit partners or banks as well and we'll find out in the coming years. My father used to work for a large bank, he would always tell me stories of breaches that occurred like people faking checks who were from Nigeria, etc. And, I asked why the banks weren't more proactive with their security procedures. He said it was because they do a cost analysis on and determine that there is an acceptable amount of risk, because securing your accounts is costly compared to the losses. I think that as these breaches increase in frequency in the digital age, that cost benefit analysis graph is going to turn upside down and not look as rosy anymore.
I read the Experian notification of the breach.
The _hack_ occurred over a "limited period of time". The _data_ that was exposed was from a two year time period.
So, no one has been hacking Experian for two years continuously.
Odds are really good that I'm affected, and believe me I know this doesn't make any difference :)
WTF would they have passport numbers for a T-Mobile phone?!?
It seems strange they'd even have a slot to store US passport numbers, considering that the vast majority of US citizens don't have or need a passport, eh?
That just struck me as odd that they'd have this stored associated with a mobile phone credit application.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Thank God that only things like Social Security numbers were stolen - easily replaceable things like credit card numbers are still safe. Whew!
Shit. I guess this might have something to do with a number of places telling me my SS# is either invalid or "has multiple names attached" (Why are multiple names attached to a single number even allowed? I would think it should return an error since there is no legitimate use for multiple names tied to a single number).
How about 2 years of high credit scores.
>revealing names, addresses, Social Security numbers, birth dates and driver's license and passport numbers for any customer
but no credit card numbers or banking data (other than your names, addresses, Social Security numbers, birth dates and driver's license and passport numbers)
>Experian is offering credit for two free years of identity resolution services and credit monitoring
Were you really planning on living longer than that?!
Most linux users don't know this, but the man pages were named after Chuck Norris. Chuck Norris fsck'ing hates noobs!
When did Lars Ulrich start working at T-Mobile?
We play the game with the bravery of being out of range
Ah, "dedicated accounts." That's just exactly like physical isolated network and storage architectures, right? So that if a cracker has, let's pretend*, a whole two years to poke around, they can't get through the impenetrable internal partitions between accounts.
*facepalm*
Air gap or GTFO.
*And by "pretend", I mean "since they actually had two years undetected"...
Welcome to the Panopticon. Used to be a prison, now it's your home.
I am posting anonymously because my company just cancelled a project with Experian. It started bad, and got worse and worse.
You may not know this, but Experian is trying to start a mailing list service, like Mailchimp. I work for a large broadcasting company, and we signed up to switch to their mailing lists. What scared the crap out of me is that we weren't just giving Experian an email address and subscribe/unsubscribe information for each mailing list. We were handing over pretty much all of the demographic data we had collected.
Think about this for a minute. Experian, the credit rating company, was being given information about your personal likes and dislikes. I could already imagine them saying, "This person likes rap music. Lower their credit rating." or, "This person only reads conservative news. Looks like a good ol' boy to me."
Fortunately, for now, Experian turned out to be totally incompetent. Their "API" was a joke, and the beautiful, fully featured front-end interface that the had "demonstrated" turned out to not exist at all. We dropped the project after converting one station, and now we are fighting to get out of the contract we signed.
Does this actually have anything to do with T-Mobile? From the sounds of it, it's Experian that was breached, and the attackers mostly (though not exclusively) took TMo subscriber info. TMo's own security wasn't compromised.
I suppose you could argue that TMo should have gone with somebody more responsible / secure than Experian, but is there actually any such entity that provides the necessary services? As low as Experian sets the "not complete shit" bar, are the other credit agencies actually any better? They all suck.
It would be nice to have a not-shit option here, of course. Naively, one would expect the free market to take care of it, but in practice there seems to only be the three agencies, all in a race to the bottom, with nobody actually interested in providing good service instead.
There's no place I could be, since I've found Serenity...
It's now been 6 years since I've had to pay for credit reports because of all the breaches my data has been involved in.
Who is RTFM and when will he help me with Unix?
At least, they have a sense of humor about it. "But no credit card numbers were stolen"? Who would need that after they have your SSN, full name, address, birthday, driver's license and PASSPORT NUMBER? That's enough to have any credit card you want. Wait, they don't have a sense of humor, do they? They are not kidding, are they? They really do think this cloud has a silver lining? Oh, what the hell. If the Secretary of State can send emails through an unsecured server, and the IRS has a 6-month's data retention policy and can get away with claiming 6 simultaneous employees' harddrives crashed right after receiving subpoenas, maybe Experian does get to get away with "but no credit card numbers were stolen" bull shit.
Any guest worker system is indistinguishable from indentured servitude.