Slashdot Mirror
Credit Reporting Firm Equifax Announces 'Cybersecurity Incident Impacting Approximately 143 Million US Consumers' (cnbc.com)
Equifax, which supplies credit information and other information services, said Thursday that a cybersecurity incident discovered on July 29 could have potentially affected 143 million consumers in the U.S. "The leaked data includes names, birth dates, social security numbers, addresses and potentially drivers licenses," reports CNBC. "209,000 U.S. credit card numbers were also obtained, in addition to 'certain dispute documents with personal identifying information for approximately 182,000 U.S. consumers."
Chairman and Chief Executive Officer, Richard F. Smith said in a statement: "This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do. I apologize to consumers and our business customers for the concern and frustration this causes. We pride ourselves on being a leader in managing and protecting data, and we are conducting a thorough review of our overall security operations. We also are focused on consumer protection and have developed a comprehensive portfolio of services to support all U.S. consumers, regardless of whether they were impacted by this incident." Equifax is now alerting customers whose information was included in the breach via mail, and is working with state and federal authorities.
UPDATE (9/7/17): According to Bloomberg, "three Equifax senior executives sold shares worth almost $1.8 million" in the days after the company discovered the security breach. Regulatory filings show that three days after the breach was discovered on July 29th, Chief Financial Officer John Gamble sold shares worth $946,374 and Joseph Loughran, president of U.S. information solutions, exercised options to dispose of stock worth $584,099." Meanwhile, "Rodolfo Ploder, president of workforce solutions, sold $250,458 of stock on Aug. 2."
Chairman and Chief Executive Officer, Richard F. Smith said in a statement: "This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do. I apologize to consumers and our business customers for the concern and frustration this causes. We pride ourselves on being a leader in managing and protecting data, and we are conducting a thorough review of our overall security operations. We also are focused on consumer protection and have developed a comprehensive portfolio of services to support all U.S. consumers, regardless of whether they were impacted by this incident." Equifax is now alerting customers whose information was included in the breach via mail, and is working with state and federal authorities.
UPDATE (9/7/17): According to Bloomberg, "three Equifax senior executives sold shares worth almost $1.8 million" in the days after the company discovered the security breach. Regulatory filings show that three days after the breach was discovered on July 29th, Chief Financial Officer John Gamble sold shares worth $946,374 and Joseph Loughran, president of U.S. information solutions, exercised options to dispose of stock worth $584,099." Meanwhile, "Rodolfo Ploder, president of workforce solutions, sold $250,458 of stock on Aug. 2."
Do I get free credit reporting for this? Is it from Equifax?
-=Lothsahn=-
At this point, is there anybody left in the U.S. who has not had their names, addresses, and socials stolen in from a hack somewhere?
CLASS ACTION LAWSUIT! These companies that want to collect all this personal data of people and fail to protect it need to be sued into non-existence!
I have never trusted these credit companies, and now I can point to why.
I don't want any more credit cards. I have no need for asking for more credit.
I don't recall ever being asked by my bank for permission to share information with Equifax or Transunion.
Would it really break the US banking system, if there was a way for us to opt out of having our spending history sent to 3rd parties?
(Equifax is third party between me and my bank)
Why is there this assumption of agreement for this sharing of information?
I don't recall any newspaper articles about a national discussion and debate on this decision?
When did it happen? Who decided that this was okay?
In the 1940s - did Equifax exist then? At some point the banks decided to share this?
Until accountability is found.
You are being ripped off every second of every day, so that advertisers can help rip you off even more tomorrow.
Obviously having a lifelong single password (SS#) is not enough anymore. But we still want identification that is relatively quickly accessed and verified. Could we reissue with a public and private key pair for each citizen? Could we trust the certs? What options can the slashdot crowd think of?
Wait. TFA says they discovered this on July 29, and that their "private investigation into the breach is complete." Only now are they going public with this? How much damage could have already been done in the month of August? The breach alone creates a huge liability for them. This delay makes it worse, because they can't blame that on some other bad actor.
...society is over. Back to subsistence living and bartering.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
David Webb, Equifax CIO, and Richard F. Smith, Equifax Chairman and CEO should both resign.
They should also forfeit any severance/golden parachutes due to the negligence that occurred on their watch.
Between this and the Anthem hack, it is statistically likely your SSN is no longer private information.
Typically when a company screws its clients, they risk clients no longer using their service, so usual market forces apply. This is not the case here. Most of their customers never chose to use Equifax or even given any explicit permission for them to collect their data. Yet, they do collect it and sell credit scores. The problem is that market forces don't work here, i.e. those customers who got hurt are not really paying, or even willing, customers and have no choice to opt out of the service, and those who buy credit scores are not really affected much.
As much as I am generally against regulation, this is one area I think they should be held fully liable, including compensating any affected customers for ALL of their expenses, including their time at some reasonable rate at or above what that customer usually makes per hour - that includes any waiting on hold while calling any of the companies to clear things out. Maybe this would cost Equifax its life, so be it, the next company will be much more careful what they do with the data. This would be no different than an airline being held liable for damaging property of killing people because their planes are shedding parts - the people hurt are not airline customers, they are the homeowners who had an aircraft parts crash through their roof into their living room.
Seems like now would be a good a time as any to update all online accounting info, passwords especiallly.
Be sure to do from a 'one off' browser session, and promptly delete afterwards.
Cookies are evil, remember? Browsers aren't much better, so that doesn't help...
Naturally, you can always move back to 'paper checks', which I contemplate every day...
Equifax, Experian and TransUnion should be held to an even higher standard because they don't collect your information... you are pretty much required to give it to them to be able to function in the US economy. This isn't a Facebook situation where the consumer trades their soul so they can see their aunt's cat pics. If you want to buy a car, a house, get a credit card, etc you have to surrender your data to these clowns (who also have proven repeatedly they do a shitty job of tracking your credit history anyway).
Someone filed a fraudulent return for me on March 30 of last year. They had their "refund" sent to a debit card. I've used the same CPA for 30 years, which gives you and idea of how well the IRS detects fraud. I have no idea how my information was stolen. A few points:
1. The best defense is to file early (e.g., February).
2. As a victim of id theft, you should qualify for a free credit freeze. Good luck. Out of six requests (3 each for me and my wife) only one was accepted. You can waste your time arguing or pay them $10 (each) to freeze it.
3. You can ask the IRS for a copy of the fraudulent return.
4. I've been a Bank of America customer for 20+ years. They couldn't handle a vehicle load with a credit freeze and I warned them my credit was frozen. Expect headaches.
Lucky for me I don't have a bank account or any debt, or even a job! You can't even find me on Google. How many people can say that?
Equifax does a lot of "high assurance" identity checks. They collect detailed biographical information on everyone; employment, relatives, mortgages, car ownership... If they lost all of that there will be hell to pay.
...if the bad guys use this stolen data and mess up your credit score.
Referencing, my primary "go to" grammar resource, it seems to case #2
http://theoatmeal.com/comics/i...
As in FUCKING RETARD?
Should you need the services of a hacker, i implore you to visit http://www.hackerspod.com/inde... or you should contact liammoore015@usa.com. i hired him for personal exploits early december last year and that was the decision that lit up my christmas and got me set for 2017. try to hire certified veterans for your hacking needs. This guy surely works like an elite, he is efficient,reliable and provides lasting and permanent solutions. He got my DUI records cleared as though it never happened and my credit card fixed.
Comment removed based on user account deletion
To even make a dent in this problem the exec's need to spend time in jail. It will force them to do the work not just get the insurance.
All my credit cards are maxed...
All my bank accounts are empty...
I am more than willing to let them have all my debts free of charge ;)
https://www.equifaxsecurity201...
Sig ?
"So how did Americans end up with a national ID number that isn't one and a card terribly unfit to identify?"
Social Security Cards Explained
.
This Space Intentionally Left Blank
Good job guys.... greeat work.
class action is so the companies can pay a token amount and get perpetual indemnity for all future legal action. The best part? With recent changes in law making mandatory arbitration legally binding at the federal level (thanks, Republican Congress and Blue Dog Dems!) you don't even get that anymore.
Folks need to start putting left wingers into Congress if they wanna see this crap happen, but nobody wants to pay the taxes for it. Nevermind that just ending the 7 wars we're running would cover it. But then I'm not so sure folks want to end those wars. Our president's largest bump in poll numbers came after he dropped a $20 million dollar bomb on a bunch of Afghani goat herders with soviet era weapons...
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
We DEMAND 72 hour mandatory reporting of security breaches that result in loss of customer data. Stop telling us nothing bad will happen to our data. You bastard companies are completely unable to protect almost anything and the government is even worse at it. At least we are learning about it now. I read something awhile back where a breach took them 14 years to discover...
1 million per persons data lost. Start by draining the assets of the board and c suite. Put them on the street.
Let's see some federal charges. one count for each share of stock affected.
Make them pay!
Regarding computer and data security, it's going to get (much) worse before it gets better. We're currently in the Dark Ages of Computer Security... but we haven't hit bottom yet.
Company culture in this area is just totally, utterly, hopelessly broken. They value speed above all else, so you end up with developers pulling libraries/jars from all over the Internet (many or most with huge security holes), you have companies incentivizing employees to get things done as quickly and cheaply as possible, you have companies clamoring for the cheapest labor available, including offshoring critical business logic.
None of these things are good for customers. It's a dumpster fire. Identities stolen, lives destroyed, and ultimately, it's us consumers who pay higher prices for all this lack of security and the resulting fraud.
It seems obvious business cannot and will not properly manage themselves when it comes to the subject of computer and data security. This is where we really need the government to step in, and lay down some laws with some serious teeth.
Oh well, one can dream...
"[We] have developed a comprehensive portfolio of services to support all U.S. consumers, regardless of whether they were impacted by this incident."
Is this Equifax shilling its consumer protections services?
Will Equifax make huge profits because now 143 million of us will need these services for the rest of our lives?
https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard
blah
For the past few decades, the economy has been increasingly based on credit, and many people are so dependent on credit, that they cannot not survive without it. Our whole system is based on easily-obtained credit, and this has inflated the supply of money far beyond what would be the case if people depended on just the cash they had, or used debit cards.
We have already witnessed the global multi-year impact of one part of the credit industry failing.
What if someone or some group were to publicly post "The List" .. of everyone's info that is currently used to obtain credit. If creditors could no longer be relatively certain that a given request for credit is actually coming from the person or business requesting it, then after a sufficient amount of fraud happens, they would cease to offer credit.
The question we are heading towards answering next is what would happen to the economy if nobody can obtain credit? Sadly, we may find out, and it may be much worse than the last credit crisis.
It signs you up for a product. READ THEIR TOS. You just waived right to class action and agreed to arbitration...
Scumbag move!
read their TOS. You use their website to signup for a product, and you waive your right to Class action and trial and agree to arbitration.
Total scumbag move. This company...
Read their TOS. You use the lookup tool to determine if you are impacted it will register you for a product. When you signup for ANY product you waive the right to CLASS ACTION and TRIAL and agree to ARBITRATION
I can use caps more if needed /s
Wow, it's going to take a long damn time for Equifax to out this tiny blemish from their permanent spot record.
"O, but she'll keep her word."
Actually, sorry Hamlet, cat's entirely out of the bag now.
This breach is why it ROYALLY pisses me off when some websites force me to answer "security" questions such as the name of the street I first lived on. The people responsible for such sites should be held accountable for gross negligence.
This is exactly why I now almost always answer the "security" questions with gibberish.
If my 20-length complex password of random digits, numbers, and special characters isn't enough for security then f it.
Also, it seems like it should be a basic civil right at this point to be allowed to change one's SSN. To be forced to deal for the rest of one's lifetime with the consequences of it having been stolen is outrageous.
It's time we make an example and take away any authorization for Equifax to store or maintain any personal information. Not that the other agencies are better, but fuck, these people are fucking useless. 1) Shut them down - Equifax must be no more. 2) Rework with systems we use so that there is real authentication like maybe possessing a smart card / EMV that provides authentication. 3) Social security numbers need to be made invalid / illegal to use as a form of authentication. 4) Credit card account numbers must be made useless by themselves, EMV only protects you if others cannot execute non-EMV transactions on the account. (Yes I know CV1 CVV2 data is generally needed for transactions) 5) We must never again design systems where data that is shared with multiple third parties is used for authentication. 6) Maybe improve EMV with some OTP system in conjunction. 7) Credit agencies need to be completely reworked. Consumers must have reliable and responsive methods of fixing fraud and errors in the data within 45 days from the report date by law. 8) Consumers suffering data loss should have legal standing for class action suit, unauthorized disclosure is a form of harm even if it can't be linked to a monetary loss.
Chairman and Chief Executive Officer, Richard F. Smith said in a statement: "This is clearly a disappointing event for our company.”
So it’s all about his company. What about the havoc his company will wreak on millions of consumers via this data breach? These a**holes collect all manner of sensitive personal data, without our permission I might add, and let it get away from them because the lot of it is on an Internet facing server connected to a web app. I think it rises to criminal negligence.
Speaking of crimes, I expect to see criminal insider trading charges and jail time for those executives who scurried off to sell their shares when the breach was discovered but left us vulnerable for weeks.
First off, the executives that sold their stocks while withholding negative information should have that money confiscated and be prosecuted for insider trading (seeing as how they were holding back negative news on purpose to profit.) The retiree pension fund should not take the hit that those assholes created in the first place...
Yet another example of the dire need for legal accountability at the federal level of companies that hold private, personal information. The three credit reporting agencies don't give a shit if your identity is stolen, either from them or from someone else, and they clearly didn't care enough to encrypt the information stolen in this breach, and all those people who are going to have to waste hundreds of hours filing police reports, fighting fraudulent credit cards taken out in their name and fraudulent loans are SOL.
It is long past time that we have a federal law holding the companies that lose private, personal data accountable to the tune of actual time lost at the billable rate for the person's profession and a fine paid to the individual harmed of not less than $1000. Once your identity has been stolen, a simple phone call or online form should permanently flag your identity and require all companies accessing your credit for a transaction must use two factor authentication to get validation of your identity.
If you disagree, please post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like
No executives will be fired for this incident.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
On planet Earth.
The people responsible for such sites should be held accountable for gross negligence.
You mean a lackey or two right? No executives are held accountable for their own decisions. In fact, the bigger the screw up the more jumps applied to the Peter Principle.
Also, it seems like it should be a basic civil right at this point to be allowed to change one's SSN. To be forced to deal for the rest of one's lifetime with the consequences of it having been stolen is outrageous.
I'm not sure you know what a civil right is. I would however support legislation which outlaws the use of one's SSN as identification to anyone other than the Government, and perhaps even more specifically the Social Security Agency.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Right now, someone who has your information but no real proof of identity can borrow money as "you", and the creditor gets to libel you via the credit reporting agencies when they don't get paid.
This must stop. Please write Congress and demand that creditors no longer have the right to libel you as a non-payer unless they can prove it was actually YOU who borrowed their money and failed to repay as promised instead of just someone who had some information about you, that they didn't bother doing due diligence on to verify.
I've already written Congress about this several times, but now it's literally EVERYONE'S information that has been stolen, and the whole nation must face the fact that they are vulnerable to this sort of thing now.
--PeterM
An illegal alien is someone who enters the country illegally. Stop making up stories to make criminal acts appear non criminal because it fits a political agenda. By your logic, I can break into your house and it's not a crime unless I broke in before.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
After, what, thirty years of companies losing our information. Don't the hackers have everyone by now? So why should we protect our information anymore? Tell the NSA to have at it. Put a bar code on my forehead, I'm done.
What's bad is that many of the offending organizations doing this are banks, educational institutions, and health providers. They must think "because we're a [bank|school|health provider] we need extra security" and then proceed to FORCE all users to answer these stupid questions.
Yes, make a law prohibiting use of SSN except by the SSA.
What would be nice is if more websites supported authentication via client certificates. Then we wouldn't have deal with passwords, two factor auth, or "security theater" questions when authenticating.
No, but the SEC may go after them.
No need to get bent out of shape about this. The solution is trivial:
1. Free credit monitoring for everybody for life. Credit bureaus pay for it as a cost of doing business.
2. If you get breached, you must pay for credit repair for any affected person whose information gets used, including reimbursement for any losses.
3. Don't like the rules? Don't collect the info. You want a loan, you go to a third party notary to check IDs and documents, witness signatures and stamp the contract. I'd take fewer CRBs and more notaries any day, and twice on Sundays.
In the present case, get everybody with a credit report free monitoring for life (paid for by CRBs jointly) and make Equifax post a bond determined by actuaries to cover the likely fallout.
I will invoice Equifax directly for this valuable service. I recommend you enjoy calling the media inquiries number as much as I did.
https://www.equifaxsecurity2017.com/ is now reporting that it is unsecure.
So now they can't even provide the information on who's been hacked.
Oh... and when it does come back up... it's a 7 day wait to get your monitoring started. Have to give the bad guys a head start. Poor form to be proactive about security, after all.
http://www.equifacks.com/
The EU is actually taking data protection much more seriously than the States with its upcoming regulations taking effect next year. The General Data Protection Regulation (GDPR) would backhand an organization like Equifax, who've experienced multiple breaches and are clearly showing signs of negligence. Money is the only thing that companies seem to understand, so this is the approach that we need to push for if we want anything to change.
GDPR emphasizes data minimization as well as hefty fines. If you don't want to pay 20million EUR or 4% of your annual revenue, then don't collect and manage any sensitive PII. It's really that simple.../sigh
I understand your frustration. The purpose of those questions is, of course, as a backup because people forget / lose their password.
> If my 20-length complex password of random digits, numbers, and special characters
Unless you're re-using the same password on all sites (bad idea) and never changing it (another bad idea) you're probably storing them somewhere rather than memorizing a dozen different sets of 20 random characters which means you could lose it. In which case you'll need to use the security questions to access your account.
So what to do? Entering gibberish means you may end up permanently locked out of your accounts, when you lose your passwords. What you can do is answer the questions will Bi CLINTON'S information, or Steve Jobs, or Mariah Carey. When it asks what city you were born in, enter the city Steve Jobs was born in. That way people can't break into your accounts by entering information about you; they'd have to know to instead enter information about Jobs or Mister Rogers or whoever you use info from.
check for arbitration agreements in the fine print
...organisations need to avoid making their (our) data a gigantic attractive target. If it were split up so attackers had to work hard for each small batch, this would be less attractive.
Requiem for the American Dream
Translation
Requiem for the American Dream
So basically Equifax just exposed all of the adults in USA and Canada to the danger of identify theft. Of course the victims can never prove their identity theft was caused by a specific breach, such as this one, so Equifax will never be found directly liable. HOWEVER, this is where the government should step in and impose massive fines for endangering the public. Those fines to be pooled into funds that help with identify theft. The fines should be in the billions, even if that means the company goes bankrupt. If it does, it will make other companies spend more money on securing their data and/or not holding onto data they don't need, simply to avoid being fined billions of dollars.
At least it's only half of the entire country. Talk about a lot of glass is half empty comments...
And is quite common but untalked about. Crimes are for the poor.
This is entirely correct. Put the blame where the blame lies. Why other countries don't have this identity theft obsession ? because
IT IS BANK FRAUD. Not "identity theft".
It should not be my problem that a third party managed to fool a bank into giving them money. Otherwise, if the tables were turned, why can't I make the bank pay me that zero-interest 100K loan their "representative" signed for me in that gas station ? He clearly showed me a Bank business card...
Why can't it never be "bank identity theft" and we make the banks pay all the promises other people make in their name ? Fair is fair.
Ellis island was a tad later than the Indian slaughter that the parent was referring to.
My company, a security company, is looking at password managers for internal use. The various security experts inside the company have been discussing LastPass.
The general consensus is that IF we use a cloud-based password manager, LastPass is a reasonable choice. However multiple co-workers and myself agree that the browser plug-in is a major risk. The browser is the #1 target not attacks, by far, and their browser plug-in is known to have security problems in the past. The browser, and therefore malicious JavaScript, should NOT have direct access to all of your passwords, in our opinion. Rather, we point out it is much more secure to copy/paste the one password you want to use at the moment from the password manager to the browser.
Additionally, if for some reason a user WAS going to use a password manager integrated with the browser, the password manager already built-inâ to Chromium / Chrome and other browsers has a better security record than LastPass.
Therefore, it is our opinion that there is more or less no use case for which the LastPass browser extension would be an appropriate solution.
http://nypost.com/2017/09/08/equifax-blames-giant-breach-on-vendor-software-flaw
Awesome moderation /.! A fact WITH A CITATION is now moderated a "troll"! More facts below this post which contain FACTS are also moderated "off topic" and down modded. Way to go!
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
> cannot argue the details with you about browser extension security or isolation from possible attack vectors ... there have never to my knowledge been any compromises.
Tavis looked at LastPass in March and reported THREE different ways for web sites (malicious JavaScript and frames) to get at all of your LastPass passwords. That's what ONE guy found in just ONE month. The technical details may not be for you, but here's an article in the popular tech press about them:
http://arstechnica.com/informa...
I would bet my team will find at least one more if LastPass shows up on our 18-hour test we do four times per year. Basically, we get 18 hours to find as many vulnerabilities as we can in an array of software.
I'm familiar with this research. But have you any evidence of an actual breach incident where data was stolen?
Also, do you expect that no technology will ever have some form of potential vulnerability? It's true that the ultimate security is simply to have a system that cannot be used. If something is so inconvenient or cumbersome to users it will never be used.. But we live in a real world where there are risks and drawbacks. As far as I can ascertain, the benefit of using Lastpass vastly exceeds the drawback in comparison with every other system.
There are basically two possible responses when someone, or a group of people, points out something you didn't think about.
Some people try to LOOK smart by continuing to argue and hope to convince readers that they know better than all of the experts. People take this to absurd extremes, to the point of arguing that it's a good idea to allow random JavaScript from any web site (or ad) to read all of your passwords.
Another type of response is to actually BE smart and learn something. These people respond with "that's a good point; I hadn't thought about that."
The thing about the first option, trying to look smarter than the experts, is that you end up trying to argue that you really want every ad on the web to have access to your bank password, and then you look dumb. Trying to look smarter just makes you look dumb. But not any ordinary dumb. The information has been presented to you and you've purposely refused to learn anything - intentional ignorance. That's extra dumb, when a person chooses, even fights, to avoid learning anything.
Funny how everyone here, normally rabid about the security and superiority of Open Source software chooses to ignore the elephant in the room.
The hack was through the use of Apache Struts that allowed access to the data. If it were Microsoft software everyone here would be gleefully jumping u[p and down on them.
When will we admit that all computer systems are inherently insecure and start making it am priority to harden all systems. When will all programmers start considering computer security as an integral part of project design and implementation?
Certainly the first step needs to be the imposition of serious penalties for company managers whenever there is a data leak. Further breach reporting laws need to be implemented so that breaches are quickly reported.