Slashdot Mirror
Experian Breached, 15 Million T-Mobile Customer's Data Exposed
New submitter Yuuki! writes: The Washington Post reports that T-Mobile's Credit Partner, Experian, has been breached revealing names, addresses, Social Security numbers, birth dates and driver's license and passport numbers for any customer who has applied for device financing or even services from T-Mobile which required a credit check. Both parties were quick to point out that no no credit card or banking data was stolen as part of the attack. The attack started back in September 2013 and was only just discovered on September 16, 2015. Both Experian and T-Mobile have posted statements on their websites and Experian is offering credit for two free years of identity resolution services and credit monitoring in the wake of the breach.
Two free years of credit monitoring after the bad guys had two free years of access! Great work, Experian!
Thank God my Credit Card numbers weren't breached, because those are impossible to cancel and replace. I'm so thankful it was only my Passport number, Driver's License number, social security number, full legal name, birth date, and address that were stolen, because those are a snap to cancel and replace.
They need to make more reparations than that, as actual remedy, compensation and punitive damages with a positive, non govt funding goal.
In corporatese, "I'm sorry" are empty words with no meaning without restitution and money.
As an identity theft victim, let me say that "no credit card or banking data was stolen" means nothing. With name, address, SSN, and birth date compromised (as well as driver's license and passport numbers), anyone can now open new lines of credit in the names of any of the 15 million people whose information was accessed. And the two years of "credit monitoring" will do almost nothing. Fraud alerts won't either - those are voluntary.
My recommendation if you are one of the 15 million people is to freeze your credit. This will stop ANYONE from opening a new line of credit under your name unless you first thaw your credit file. It's a royal pain in the rear when you need to do things like refinance a loan, but it's better than having a collections agency banging down your door because you owe $5,000 on a credit card that "you" opened.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
...there won't even be the same sort of mass outrage associated with this. Only a few geeks will even notice or pay attention. Making it even less likely that anything will change.
A Pirate and a Puritan look the same on a balance sheet.
One of the three major credit rating services? I'm a little bit impressed that this breach was limited to only everyone who has ever applied for T-Mobile service.
Guess what they're not giving you? Your actual credit report. You just get the abbreviated version, so you can't actually look it over and see if this generally corrupt industry is fucking you. They will, however, sell you your credit report at a special members-only price. So what's happened here basically is that Experian is getting free advertising and T-Mobile is going to get off without punishment.
Fuck you Experian, and fuck you T-Mobile.
I already said fuck T-Mobile since they cancelled the PAYG plans I've been using, but fuck them twice now.
Are there ANY US mobile providers from whom I can buy a PAYG SIM which are not total fucks?
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
One of the best things that can be done to prevent data breaches is require that data be deleted after a certain time. I don't see a good reason why 15 million customers should have their data retained after the credit check is complete. It won't stop breaches, but it would limit their scope. There also needs to be severe penalties for negligent security or failing to notify customers in a timely manner. Better yet, eliminate social security numbers for identification altogether outside of social security and (maybe) tax purposes. And it's no surprise that a credit bureau was attacked. They're gold mines of information waiting to be compromised. I'd like to see particularly strong regulation of these companies. Consumers don't really get to opt in, but this personal information is stored and can be compromised easily. That doesn't seem fair at all to me.
Experian is offer a two year free credit monitoring in connection with the breach of their system. In order to sign up for the two year credit monitoring they require you to provide your full identity; SS number, birth date, etc. Isn't that just the information that was just compromised in their system??? How do they think they can be trusted??? This does not resolve the problem of their lack of network security with sensitive information.
It is high time the abuse of the Social Security Number ended. SSNs should be used for one thing: Social Security. Using a single "secret number" is an archaic system that for increasing numbers of people is no longer secret. Let's not forget all your other details which are used to identify you but aren't really that secret (your full name, your birthday, etc).
This information is used for identifying a person or proving identity so it's an authentication problem. We can do better! We have public key encryption. The government issues you a key pair (say, embedded into a photo ID, which we all have already) and now you can prove your identity without giving someone an irrevocable secret.
Authentication is also two factor: You have an ID and you know a PIN (or passphrase). If you lose your card, then your identity is not immediately compromised because it is protected by your PIN. This gives you time to have the gov't revoke your old key pair and issue you a new one.
In the case of the credit bureaus (I think we can all safely assume credit isn't going away any time soon), they associate your credit history with your public key and nothing else. If the key is revoked (by the gov't), then they move your file to the new key. No one can take out credit using the old key. In fact, any attempt could be reported to law enforcement.
The entire US Department of Defense has been using a system like this for years now and has by and large done away with things like passwords and hand signatures, especially for the things that matter most.
Is this completely foolproof to prevent someone impersonating you? No, but it is much better than having your SSN and other PII out on some forum where just anyone can use it for nefarious purposes and would be well worth its cost and complexity. The greatest obstacle is the credit bureaus having nothing to gain in actually protecting their "customers'" data because then to whom will they sell credit monitoring?
Fascism should more properly be called corporatism because it is the merger of state and corporate power. -- Mussolini
All told, I have 17,300 years of credit monitoring due to various corporate negligence.
There's no way they're going to steal my identity again!
"15 million". Huge number. It usually takes the power of the US Federal Government to screw up this big.
But one thing is not clear from TFA, let alone from the slightly misleading TFS.
This is an Experian hack, not a T-Mobile hack. What makes any "expert" think the exposure is limited to someone who interacted with T-Mobile? Experian is one of the awful ubiquitous unavoidable facts of life, much like the Government (see above). If you have participated in any non-cash financial transaction, they probably have a file on you.
What are the particulars of this breach that make it strictly an "Experian interacting with T-Mobile" risk? Experian is huge, and if you're counting on some kind of strict internal data partitioning within the company to restrict the attack area to "T-Mobile applicants" you're too naive to sit with the grown-ups.
Seriously. Why the fuck isn't this a maximal-sized no-holds-barred every-file-Experian-holds breach?
Welcome to the Panopticon. Used to be a prison, now it's your home.
I can at least understand the shooting becoming the top story for a while (if it bleeds it leads), but it's obvious how far the news media has fallen when "the Pope is Catholic" is headline news.
Socialism: a lie told by totalitarians and believed by fools.
Experian partitioned clients apart from one another. The breach hit their T-Mobile systems, which is why they are mentioning it only affects T-Mobile customers. But, you are right not to trust Experian, if it happened to one of their systems it could be happening as we speak to any other of their clients. It could also be happening to any of the other credit partners or banks as well and we'll find out in the coming years. My father used to work for a large bank, he would always tell me stories of breaches that occurred like people faking checks who were from Nigeria, etc. And, I asked why the banks weren't more proactive with their security procedures. He said it was because they do a cost analysis on and determine that there is an acceptable amount of risk, because securing your accounts is costly compared to the losses. I think that as these breaches increase in frequency in the digital age, that cost benefit analysis graph is going to turn upside down and not look as rosy anymore.