Government Officials Begin Investigating Equifax Breach (thehill.com)

An anonymous reader quotes the Hill: The massive breach of credit rating firm Equifax is attracting scrutiny from government officials across the country. Lawmakers from both parties have expressed concern over the hack, which could have left vulnerable sensitive personal information for as many as 143 million people. The New York, Pennsylvania and Illinois attorneys general have announced formal investigations into the hack...

The Senate Commerce Committee announced on Thursday that it sent a letter to Equifax seeking answers about the extent of the breach and what Equifax is doing to mitigate its impact. In the House, Financial Services Committee Chairman Jeb Hensarling (R-Texas) said that his committee would hold a hearing on the hacks at a to-be-determined date. Hensarling noted in a statement that such breaches are becoming "too common" and that consumers "deserve answers." House Energy and Commerce Committee Chairman Greg Walden (R-Ore.) said that his committee would hold a separate hearing on the matter as well.

Comments

Re:Isn't 143M basically all adults in America?

[DarkOx]

I don't know that it has. Whoever stole the data isn't going to just dump it online they are going to sell it. Eventually it will all leak but not before much of it is quite stale.

Most people STILL don't realize this but anyone who works for a company with a subscription to any of the private investigative services could pretty much get all this information inside of 30 seconds. Not everyone is in the pay-for-use-databases but most are. I don't know if I have ever had a search come back empty.

The reality is this information was already out there on almost everyone one, this will be just one more source. Maybe a price a little more attractive to the ner'er do wells but I predict a minor blip in increased id theft at most.

Re:Isn't 143M basically all adults in America?

[coofercat]

I worked for a financially-regulated place here in the UK and every once in a while you'd hear "that sort of f-up could see us lose our license" (and so stuff didn't happen) - exactly what the regulator intended (and for the most part, it seemed like a good outcome, from what I could tell).

In the case of Equifax in the US - why do they need SSNs? I presume it's a way to differentiate Jim Kirk from New York and Jim Kirk from Boston. I don't imagine they ever actually have a need to use the SSN with someone else (right?). In which case, they could have simply hashed the SSN on receipt and stored the hash. Right now, they'd still be in a world of trouble, but a lot less than they actually are (and could arguably have been a smaller target).

I guess what I'm asking is what could (really) cause such an incredible failure of judgement/execution on their part? Even the US's relatively slack laws on data protection would at least make hashing SSNs something you might at least think about, don't they?

Whilst I agree that some major sanctions against companies doing this sort of thing is definitely in order (here, the US might do well to look to the EU or Singapore for some ideas), but will that actually solve the real, core, underlying issue that let this happen in the first place, or will it just throw a couple of extra firewalls on the network for "due diligence" and leave the same crappy implementation choices in the systems that actually run the show?

Re:And I hope but don't hold my breath

[hawkinspeter]

What about all the insider trading? The Execs dumped loads of their stock before worrying about contacting anyone that might be affected by this.