Slashdot Mirror
Credit Reporting Firm Equifax Announces 'Cybersecurity Incident Impacting Approximately 143 Million US Consumers' (cnbc.com)
Equifax, which supplies credit information and other information services, said Thursday that a cybersecurity incident discovered on July 29 could have potentially affected 143 million consumers in the U.S. "The leaked data includes names, birth dates, social security numbers, addresses and potentially drivers licenses," reports CNBC. "209,000 U.S. credit card numbers were also obtained, in addition to 'certain dispute documents with personal identifying information for approximately 182,000 U.S. consumers."
Chairman and Chief Executive Officer, Richard F. Smith said in a statement: "This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do. I apologize to consumers and our business customers for the concern and frustration this causes. We pride ourselves on being a leader in managing and protecting data, and we are conducting a thorough review of our overall security operations. We also are focused on consumer protection and have developed a comprehensive portfolio of services to support all U.S. consumers, regardless of whether they were impacted by this incident." Equifax is now alerting customers whose information was included in the breach via mail, and is working with state and federal authorities.
UPDATE (9/7/17): According to Bloomberg, "three Equifax senior executives sold shares worth almost $1.8 million" in the days after the company discovered the security breach. Regulatory filings show that three days after the breach was discovered on July 29th, Chief Financial Officer John Gamble sold shares worth $946,374 and Joseph Loughran, president of U.S. information solutions, exercised options to dispose of stock worth $584,099." Meanwhile, "Rodolfo Ploder, president of workforce solutions, sold $250,458 of stock on Aug. 2."
Chairman and Chief Executive Officer, Richard F. Smith said in a statement: "This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do. I apologize to consumers and our business customers for the concern and frustration this causes. We pride ourselves on being a leader in managing and protecting data, and we are conducting a thorough review of our overall security operations. We also are focused on consumer protection and have developed a comprehensive portfolio of services to support all U.S. consumers, regardless of whether they were impacted by this incident." Equifax is now alerting customers whose information was included in the breach via mail, and is working with state and federal authorities.
UPDATE (9/7/17): According to Bloomberg, "three Equifax senior executives sold shares worth almost $1.8 million" in the days after the company discovered the security breach. Regulatory filings show that three days after the breach was discovered on July 29th, Chief Financial Officer John Gamble sold shares worth $946,374 and Joseph Loughran, president of U.S. information solutions, exercised options to dispose of stock worth $584,099." Meanwhile, "Rodolfo Ploder, president of workforce solutions, sold $250,458 of stock on Aug. 2."
At this point, is there anybody left in the U.S. who has not had their names, addresses, and socials stolen in from a hack somewhere?
CLASS ACTION LAWSUIT! These companies that want to collect all this personal data of people and fail to protect it need to be sued into non-existence!
Typically when a company screws its clients, they risk clients no longer using their service, so usual market forces apply. This is not the case here. Most of their customers never chose to use Equifax or even given any explicit permission for them to collect their data. Yet, they do collect it and sell credit scores. The problem is that market forces don't work here, i.e. those customers who got hurt are not really paying, or even willing, customers and have no choice to opt out of the service, and those who buy credit scores are not really affected much.
As much as I am generally against regulation, this is one area I think they should be held fully liable, including compensating any affected customers for ALL of their expenses, including their time at some reasonable rate at or above what that customer usually makes per hour - that includes any waiting on hold while calling any of the companies to clear things out. Maybe this would cost Equifax its life, so be it, the next company will be much more careful what they do with the data. This would be no different than an airline being held liable for damaging property of killing people because their planes are shedding parts - the people hurt are not airline customers, they are the homeowners who had an aircraft parts crash through their roof into their living room.
Social Security numbers are fine. The problem is that organizations have foolishly been using them for authentication ("Prove you are you!"), rather than merely identification ("Who are we talking about?"), which was all they were ever designed to do. As a means for identification, it generally still works just as well today as it did when it began. As a method for authentication, it was lousy from the start and has been getting worse by the day.
Equifax, Experian and TransUnion should be held to an even higher standard because they don't collect your information... you are pretty much required to give it to them to be able to function in the US economy. This isn't a Facebook situation where the consumer trades their soul so they can see their aunt's cat pics. If you want to buy a car, a house, get a credit card, etc you have to surrender your data to these clowns (who also have proven repeatedly they do a shitty job of tracking your credit history anyway).
Neither did Equifax, I'm sure. They're crime is not securing their systems, which would obviously be a very attractive fruit for any hacker to try to pluck, and in a perfect world Equifax would be fined billions of dollars and its management would rot in prison cells for a very long time. As it is, I'm sure the FCC will do some shoddy little investigation that amounts to a few million dollars in fines, there will be a class action lawsuit that probably will see some small fraction of the victims get some measly payout sometime before the heat death of the Universe.
I'll tell you whose clinking their champagne glasses right now, it's the lawyers. No matter who loses, they always win.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Chairman and Chief Executive Officer, Richard F. Smith said in a statement: "This is clearly a disappointing event for our company.”
So it’s all about his company. What about the havoc his company will wreak on millions of consumers via this data breach? These a**holes collect all manner of sensitive personal data, without our permission I might add, and let it get away from them because the lot of it is on an Internet facing server connected to a web app. I think it rises to criminal negligence.
Speaking of crimes, I expect to see criminal insider trading charges and jail time for those executives who scurried off to sell their shares when the breach was discovered but left us vulnerable for weeks.
No executives will be fired for this incident.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
On planet Earth.
The people responsible for such sites should be held accountable for gross negligence.
You mean a lackey or two right? No executives are held accountable for their own decisions. In fact, the bigger the screw up the more jumps applied to the Peter Principle.
Also, it seems like it should be a basic civil right at this point to be allowed to change one's SSN. To be forced to deal for the rest of one's lifetime with the consequences of it having been stolen is outrageous.
I'm not sure you know what a civil right is. I would however support legislation which outlaws the use of one's SSN as identification to anyone other than the Government, and perhaps even more specifically the Social Security Agency.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Right now, someone who has your information but no real proof of identity can borrow money as "you", and the creditor gets to libel you via the credit reporting agencies when they don't get paid.
This must stop. Please write Congress and demand that creditors no longer have the right to libel you as a non-payer unless they can prove it was actually YOU who borrowed their money and failed to repay as promised instead of just someone who had some information about you, that they didn't bother doing due diligence on to verify.
I've already written Congress about this several times, but now it's literally EVERYONE'S information that has been stolen, and the whole nation must face the fact that they are vulnerable to this sort of thing now.
--PeterM
The issue is that it's a matter of historical perspective.
No, it isn't. It's about the law. Hence "illegal" is in the term.
Most people in the US are illegal aliens from the point of view of native Americans who got there first.
In the point of view of native Americans, they didn't have the same legal systems or same concepts on law, land ownership, borders, etc as us. You're committing the same mistake as Europeans of the past, who had conflicts with native Americans because they didn't understand that the two cultures had different value systems and way of doing things.