Slashdot Mirror
Credit Reporting Firm Equifax Announces 'Cybersecurity Incident Impacting Approximately 143 Million US Consumers' (cnbc.com)
Equifax, which supplies credit information and other information services, said Thursday that a cybersecurity incident discovered on July 29 could have potentially affected 143 million consumers in the U.S. "The leaked data includes names, birth dates, social security numbers, addresses and potentially drivers licenses," reports CNBC. "209,000 U.S. credit card numbers were also obtained, in addition to 'certain dispute documents with personal identifying information for approximately 182,000 U.S. consumers."
Chairman and Chief Executive Officer, Richard F. Smith said in a statement: "This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do. I apologize to consumers and our business customers for the concern and frustration this causes. We pride ourselves on being a leader in managing and protecting data, and we are conducting a thorough review of our overall security operations. We also are focused on consumer protection and have developed a comprehensive portfolio of services to support all U.S. consumers, regardless of whether they were impacted by this incident." Equifax is now alerting customers whose information was included in the breach via mail, and is working with state and federal authorities.
UPDATE (9/7/17): According to Bloomberg, "three Equifax senior executives sold shares worth almost $1.8 million" in the days after the company discovered the security breach. Regulatory filings show that three days after the breach was discovered on July 29th, Chief Financial Officer John Gamble sold shares worth $946,374 and Joseph Loughran, president of U.S. information solutions, exercised options to dispose of stock worth $584,099." Meanwhile, "Rodolfo Ploder, president of workforce solutions, sold $250,458 of stock on Aug. 2."
Chairman and Chief Executive Officer, Richard F. Smith said in a statement: "This is clearly a disappointing event for our company, and one that strikes at the heart of who we are and what we do. I apologize to consumers and our business customers for the concern and frustration this causes. We pride ourselves on being a leader in managing and protecting data, and we are conducting a thorough review of our overall security operations. We also are focused on consumer protection and have developed a comprehensive portfolio of services to support all U.S. consumers, regardless of whether they were impacted by this incident." Equifax is now alerting customers whose information was included in the breach via mail, and is working with state and federal authorities.
UPDATE (9/7/17): According to Bloomberg, "three Equifax senior executives sold shares worth almost $1.8 million" in the days after the company discovered the security breach. Regulatory filings show that three days after the breach was discovered on July 29th, Chief Financial Officer John Gamble sold shares worth $946,374 and Joseph Loughran, president of U.S. information solutions, exercised options to dispose of stock worth $584,099." Meanwhile, "Rodolfo Ploder, president of workforce solutions, sold $250,458 of stock on Aug. 2."
Do I get free credit reporting for this? Is it from Equifax?
-=Lothsahn=-
At this point, is there anybody left in the U.S. who has not had their names, addresses, and socials stolen in from a hack somewhere?
CLASS ACTION LAWSUIT! These companies that want to collect all this personal data of people and fail to protect it need to be sued into non-existence!
I have never trusted these credit companies, and now I can point to why.
I don't want any more credit cards. I have no need for asking for more credit.
I don't recall ever being asked by my bank for permission to share information with Equifax or Transunion.
Would it really break the US banking system, if there was a way for us to opt out of having our spending history sent to 3rd parties?
(Equifax is third party between me and my bank)
Why is there this assumption of agreement for this sharing of information?
I don't recall any newspaper articles about a national discussion and debate on this decision?
When did it happen? Who decided that this was okay?
In the 1940s - did Equifax exist then? At some point the banks decided to share this?
Until accountability is found.
You are being ripped off every second of every day, so that advertisers can help rip you off even more tomorrow.
Obviously having a lifelong single password (SS#) is not enough anymore. But we still want identification that is relatively quickly accessed and verified. Could we reissue with a public and private key pair for each citizen? Could we trust the certs? What options can the slashdot crowd think of?
Wait. TFA says they discovered this on July 29, and that their "private investigation into the breach is complete." Only now are they going public with this? How much damage could have already been done in the month of August? The breach alone creates a huge liability for them. This delay makes it worse, because they can't blame that on some other bad actor.
...society is over. Back to subsistence living and bartering.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
Typically when a company screws its clients, they risk clients no longer using their service, so usual market forces apply. This is not the case here. Most of their customers never chose to use Equifax or even given any explicit permission for them to collect their data. Yet, they do collect it and sell credit scores. The problem is that market forces don't work here, i.e. those customers who got hurt are not really paying, or even willing, customers and have no choice to opt out of the service, and those who buy credit scores are not really affected much.
As much as I am generally against regulation, this is one area I think they should be held fully liable, including compensating any affected customers for ALL of their expenses, including their time at some reasonable rate at or above what that customer usually makes per hour - that includes any waiting on hold while calling any of the companies to clear things out. Maybe this would cost Equifax its life, so be it, the next company will be much more careful what they do with the data. This would be no different than an airline being held liable for damaging property of killing people because their planes are shedding parts - the people hurt are not airline customers, they are the homeowners who had an aircraft parts crash through their roof into their living room.
Equifax, Experian and TransUnion should be held to an even higher standard because they don't collect your information... you are pretty much required to give it to them to be able to function in the US economy. This isn't a Facebook situation where the consumer trades their soul so they can see their aunt's cat pics. If you want to buy a car, a house, get a credit card, etc you have to surrender your data to these clowns (who also have proven repeatedly they do a shitty job of tracking your credit history anyway).
Someone filed a fraudulent return for me on March 30 of last year. They had their "refund" sent to a debit card. I've used the same CPA for 30 years, which gives you and idea of how well the IRS detects fraud. I have no idea how my information was stolen. A few points:
1. The best defense is to file early (e.g., February).
2. As a victim of id theft, you should qualify for a free credit freeze. Good luck. Out of six requests (3 each for me and my wife) only one was accepted. You can waste your time arguing or pay them $10 (each) to freeze it.
3. You can ask the IRS for a copy of the fraudulent return.
4. I've been a Bank of America customer for 20+ years. They couldn't handle a vehicle load with a credit freeze and I warned them my credit was frozen. Expect headaches.
Equifax does a lot of "high assurance" identity checks. They collect detailed biographical information on everyone; employment, relatives, mortgages, car ownership... If they lost all of that there will be hell to pay.
Baloney. I just did a search for "Anonymous Coward" and got millions of results. Your info is all over the place.
#DeleteChrome
...if the bad guys use this stolen data and mess up your credit score.
Referencing, my primary "go to" grammar resource, it seems to case #2
http://theoatmeal.com/comics/i...
Should you need the services of a hacker, i implore you to visit http://www.hackerspod.com/inde... or you should contact liammoore015@usa.com. i hired him for personal exploits early december last year and that was the decision that lit up my christmas and got me set for 2017. try to hire certified veterans for your hacking needs. This guy surely works like an elite, he is efficient,reliable and provides lasting and permanent solutions. He got my DUI records cleared as though it never happened and my credit card fixed.
Comment removed based on user account deletion
https://www.equifaxsecurity201...
Sig ?
"So how did Americans end up with a national ID number that isn't one and a card terribly unfit to identify?"
Social Security Cards Explained
.
This Space Intentionally Left Blank
class action is so the companies can pay a token amount and get perpetual indemnity for all future legal action. The best part? With recent changes in law making mandatory arbitration legally binding at the federal level (thanks, Republican Congress and Blue Dog Dems!) you don't even get that anymore.
Folks need to start putting left wingers into Congress if they wanna see this crap happen, but nobody wants to pay the taxes for it. Nevermind that just ending the 7 wars we're running would cover it. But then I'm not so sure folks want to end those wars. Our president's largest bump in poll numbers came after he dropped a $20 million dollar bomb on a bunch of Afghani goat herders with soviet era weapons...
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
We DEMAND 72 hour mandatory reporting of security breaches that result in loss of customer data. Stop telling us nothing bad will happen to our data. You bastard companies are completely unable to protect almost anything and the government is even worse at it. At least we are learning about it now. I read something awhile back where a breach took them 14 years to discover...
1 million per persons data lost. Start by draining the assets of the board and c suite. Put them on the street.
Let's see some federal charges. one count for each share of stock affected.
Make them pay!
Regarding computer and data security, it's going to get (much) worse before it gets better. We're currently in the Dark Ages of Computer Security... but we haven't hit bottom yet.
Company culture in this area is just totally, utterly, hopelessly broken. They value speed above all else, so you end up with developers pulling libraries/jars from all over the Internet (many or most with huge security holes), you have companies incentivizing employees to get things done as quickly and cheaply as possible, you have companies clamoring for the cheapest labor available, including offshoring critical business logic.
None of these things are good for customers. It's a dumpster fire. Identities stolen, lives destroyed, and ultimately, it's us consumers who pay higher prices for all this lack of security and the resulting fraud.
It seems obvious business cannot and will not properly manage themselves when it comes to the subject of computer and data security. This is where we really need the government to step in, and lay down some laws with some serious teeth.
Oh well, one can dream...
https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard
blah
It signs you up for a product. READ THEIR TOS. You just waived right to class action and agreed to arbitration...
Scumbag move!
read their TOS. You use their website to signup for a product, and you waive your right to Class action and trial and agree to arbitration.
Total scumbag move. This company...
Wow, it's going to take a long damn time for Equifax to out this tiny blemish from their permanent spot record.
"O, but she'll keep her word."
Actually, sorry Hamlet, cat's entirely out of the bag now.
This breach is why it ROYALLY pisses me off when some websites force me to answer "security" questions such as the name of the street I first lived on. The people responsible for such sites should be held accountable for gross negligence.
This is exactly why I now almost always answer the "security" questions with gibberish.
If my 20-length complex password of random digits, numbers, and special characters isn't enough for security then f it.
Also, it seems like it should be a basic civil right at this point to be allowed to change one's SSN. To be forced to deal for the rest of one's lifetime with the consequences of it having been stolen is outrageous.
It's time we make an example and take away any authorization for Equifax to store or maintain any personal information. Not that the other agencies are better, but fuck, these people are fucking useless. 1) Shut them down - Equifax must be no more. 2) Rework with systems we use so that there is real authentication like maybe possessing a smart card / EMV that provides authentication. 3) Social security numbers need to be made invalid / illegal to use as a form of authentication. 4) Credit card account numbers must be made useless by themselves, EMV only protects you if others cannot execute non-EMV transactions on the account. (Yes I know CV1 CVV2 data is generally needed for transactions) 5) We must never again design systems where data that is shared with multiple third parties is used for authentication. 6) Maybe improve EMV with some OTP system in conjunction. 7) Credit agencies need to be completely reworked. Consumers must have reliable and responsive methods of fixing fraud and errors in the data within 45 days from the report date by law. 8) Consumers suffering data loss should have legal standing for class action suit, unauthorized disclosure is a form of harm even if it can't be linked to a monetary loss.
Chairman and Chief Executive Officer, Richard F. Smith said in a statement: "This is clearly a disappointing event for our company.”
So it’s all about his company. What about the havoc his company will wreak on millions of consumers via this data breach? These a**holes collect all manner of sensitive personal data, without our permission I might add, and let it get away from them because the lot of it is on an Internet facing server connected to a web app. I think it rises to criminal negligence.
Speaking of crimes, I expect to see criminal insider trading charges and jail time for those executives who scurried off to sell their shares when the breach was discovered but left us vulnerable for weeks.
First off, the executives that sold their stocks while withholding negative information should have that money confiscated and be prosecuted for insider trading (seeing as how they were holding back negative news on purpose to profit.) The retiree pension fund should not take the hit that those assholes created in the first place...
Yet another example of the dire need for legal accountability at the federal level of companies that hold private, personal information. The three credit reporting agencies don't give a shit if your identity is stolen, either from them or from someone else, and they clearly didn't care enough to encrypt the information stolen in this breach, and all those people who are going to have to waste hundreds of hours filing police reports, fighting fraudulent credit cards taken out in their name and fraudulent loans are SOL.
It is long past time that we have a federal law holding the companies that lose private, personal data accountable to the tune of actual time lost at the billable rate for the person's profession and a fine paid to the individual harmed of not less than $1000. Once your identity has been stolen, a simple phone call or online form should permanently flag your identity and require all companies accessing your credit for a transaction must use two factor authentication to get validation of your identity.
If you disagree, please post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like
No executives will be fired for this incident.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
On planet Earth.
The people responsible for such sites should be held accountable for gross negligence.
You mean a lackey or two right? No executives are held accountable for their own decisions. In fact, the bigger the screw up the more jumps applied to the Peter Principle.
Also, it seems like it should be a basic civil right at this point to be allowed to change one's SSN. To be forced to deal for the rest of one's lifetime with the consequences of it having been stolen is outrageous.
I'm not sure you know what a civil right is. I would however support legislation which outlaws the use of one's SSN as identification to anyone other than the Government, and perhaps even more specifically the Social Security Agency.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Right now, someone who has your information but no real proof of identity can borrow money as "you", and the creditor gets to libel you via the credit reporting agencies when they don't get paid.
This must stop. Please write Congress and demand that creditors no longer have the right to libel you as a non-payer unless they can prove it was actually YOU who borrowed their money and failed to repay as promised instead of just someone who had some information about you, that they didn't bother doing due diligence on to verify.
I've already written Congress about this several times, but now it's literally EVERYONE'S information that has been stolen, and the whole nation must face the fact that they are vulnerable to this sort of thing now.
--PeterM
What's bad is that many of the offending organizations doing this are banks, educational institutions, and health providers. They must think "because we're a [bank|school|health provider] we need extra security" and then proceed to FORCE all users to answer these stupid questions.
Yes, make a law prohibiting use of SSN except by the SSA.
What would be nice is if more websites supported authentication via client certificates. Then we wouldn't have deal with passwords, two factor auth, or "security theater" questions when authenticating.
http://www.equifacks.com/
I agree. If you're a company such as the big 3 creditors, even without a breach, you should be required to provide these services free of charge to those whose data you hold. You have that data, it's your responsibility to ensure it is not misused. If you can't do that, then you shouldn't be a provider of a service that is as critical to life in the US as the air that is breathed by those that live there.
I understand your frustration. The purpose of those questions is, of course, as a backup because people forget / lose their password.
> If my 20-length complex password of random digits, numbers, and special characters
Unless you're re-using the same password on all sites (bad idea) and never changing it (another bad idea) you're probably storing them somewhere rather than memorizing a dozen different sets of 20 random characters which means you could lose it. In which case you'll need to use the security questions to access your account.
So what to do? Entering gibberish means you may end up permanently locked out of your accounts, when you lose your passwords. What you can do is answer the questions will Bi CLINTON'S information, or Steve Jobs, or Mariah Carey. When it asks what city you were born in, enter the city Steve Jobs was born in. That way people can't break into your accounts by entering information about you; they'd have to know to instead enter information about Jobs or Mister Rogers or whoever you use info from.
...organisations need to avoid making their (our) data a gigantic attractive target. If it were split up so attackers had to work hard for each small batch, this would be less attractive.
Requiem for the American Dream
Translation
Requiem for the American Dream
So basically Equifax just exposed all of the adults in USA and Canada to the danger of identify theft. Of course the victims can never prove their identity theft was caused by a specific breach, such as this one, so Equifax will never be found directly liable. HOWEVER, this is where the government should step in and impose massive fines for endangering the public. Those fines to be pooled into funds that help with identify theft. The fines should be in the billions, even if that means the company goes bankrupt. If it does, it will make other companies spend more money on securing their data and/or not holding onto data they don't need, simply to avoid being fined billions of dollars.
The issue is that it's a matter of historical perspective. Most people in the US are illegal aliens from the point of view of native Americans who got there first.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
The issue is that it's a matter of historical perspective.
No, it isn't. It's about the law. Hence "illegal" is in the term.
Most people in the US are illegal aliens from the point of view of native Americans who got there first.
In the point of view of native Americans, they didn't have the same legal systems or same concepts on law, land ownership, borders, etc as us. You're committing the same mistake as Europeans of the past, who had conflicts with native Americans because they didn't understand that the two cultures had different value systems and way of doing things.
At least it's only half of the entire country. Talk about a lot of glass is half empty comments...
Unfortunately the credit monitoring you get when a breach happens is always from these reporting agencies. I think I have like 5 or 6 active ones across experian, equifax, and transunion. Now it looks like I and everyone else will get another year of free credit monitoring from these fuckers that really should be drawn and quartered instead.
Time to offend someone
Why? Which of them had any opportunity at all to prevent this?
Some of them will have worked on the breached system, but again, why would a company like Equifax ever trust them to properly secure it?
Surely the people running the company should be mandating, funding and auditing adequate security processes, including providing the right tools and skilled people to execute them.
You don't sack a DBA for failing to secure a database, you teach them how to secure the next one. You spot that it isn't secure, fix it and then wrap it in monitoring, logging, intrusion detection and all the other goodness that means that even if it does have a vulnerability you didn't spot, you can detect and respond to the breach in seconds or minutes, no two fucking months.
My company, a security company, is looking at password managers for internal use. The various security experts inside the company have been discussing LastPass.
The general consensus is that IF we use a cloud-based password manager, LastPass is a reasonable choice. However multiple co-workers and myself agree that the browser plug-in is a major risk. The browser is the #1 target not attacks, by far, and their browser plug-in is known to have security problems in the past. The browser, and therefore malicious JavaScript, should NOT have direct access to all of your passwords, in our opinion. Rather, we point out it is much more secure to copy/paste the one password you want to use at the moment from the password manager to the browser.
Additionally, if for some reason a user WAS going to use a password manager integrated with the browser, the password manager already built-inâ to Chromium / Chrome and other browsers has a better security record than LastPass.
Therefore, it is our opinion that there is more or less no use case for which the LastPass browser extension would be an appropriate solution.
"Illegal," in any legal context has a component of "punishment."
Undocumented immigrants who are "first-timers," are simply given due process and deported.
There is a free ride, meals and accommodations prior to ejection, but there is no punishment.
Because the first-timer is identified and documented, subsequent entry is illegal.
It little behooves the best of us to comment on the rest of us.
Awesome moderation /.! A fact WITH A CITATION is now moderated a "troll"! More facts below this post which contain FACTS are also moderated "off topic" and down modded. Way to go!
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
> cannot argue the details with you about browser extension security or isolation from possible attack vectors ... there have never to my knowledge been any compromises.
Tavis looked at LastPass in March and reported THREE different ways for web sites (malicious JavaScript and frames) to get at all of your LastPass passwords. That's what ONE guy found in just ONE month. The technical details may not be for you, but here's an article in the popular tech press about them:
http://arstechnica.com/informa...
I would bet my team will find at least one more if LastPass shows up on our 18-hour test we do four times per year. Basically, we get 18 hours to find as many vulnerabilities as we can in an array of software.
I'm familiar with this research. But have you any evidence of an actual breach incident where data was stolen?
Also, do you expect that no technology will ever have some form of potential vulnerability? It's true that the ultimate security is simply to have a system that cannot be used. If something is so inconvenient or cumbersome to users it will never be used.. But we live in a real world where there are risks and drawbacks. As far as I can ascertain, the benefit of using Lastpass vastly exceeds the drawback in comparison with every other system.
There are basically two possible responses when someone, or a group of people, points out something you didn't think about.
Some people try to LOOK smart by continuing to argue and hope to convince readers that they know better than all of the experts. People take this to absurd extremes, to the point of arguing that it's a good idea to allow random JavaScript from any web site (or ad) to read all of your passwords.
Another type of response is to actually BE smart and learn something. These people respond with "that's a good point; I hadn't thought about that."
The thing about the first option, trying to look smarter than the experts, is that you end up trying to argue that you really want every ad on the web to have access to your bank password, and then you look dumb. Trying to look smarter just makes you look dumb. But not any ordinary dumb. The information has been presented to you and you've purposely refused to learn anything - intentional ignorance. That's extra dumb, when a person chooses, even fights, to avoid learning anything.