Equifax Lobbied For Easier Regulation Before Data Breach (wsj.com)

WSJ reports: Equifax was lobbying lawmakers and federal agencies to ease up on regulation of credit-reporting companies in the months before its massive data breach. Equifax spent at least $500,000 on lobbying Congress and federal regulators in the first half of 2017, according to its congressional lobbying-disclosure reports. Among the issues on which it lobbied was limiting the legal liability of credit-reporting companies. That issue is the subject of a bill that a panel of the House Financial Services Committee, which oversees the industry, discussed the same day Equifax disclosed the cyberattack that exposed personal financial data of as many as 143 million Americans. Equifax has also lobbied Congress and regulatory agencies on issues around "data security and breach notification" and "cybersecurity threat information sharing," according to its lobbying disclosures. The amount Equifax spent in the first half of this year appears to be in line with previous spending. In 2016 and 2015, the company's reports show it spent $1.1 million and $1.02 million, respectively, on lobbying activities. While the company had broadly similar lobbying issues in those years, the liability matter was new in 2017.

Comments

They knew

[Calydor]

They knew about the breach when they started lobbying for that. LONG before the poor schmucks were allowed to know about it.

Re:They knew

[Anonymous Coward]

It sure looks that way. They need to be made an example of by Congress, regardless of who they have in their pocket already.

Re:They knew

[PolygamousRanchKid]

They knew about the breach when they started lobbying for that.

How do we even know if this was a "breach" at all . . . ? Maybe some folks at Equifax were just following the Facebook and Google business model, and were just selling "information services" on the side . . . ?

Hey, the old, time-tested methods work best: You want something? Bribe or blackmail someone. It works all the time.

Re:They knew

[mi]

Maybe. But what we can claim with certainty is that the existing regulations did not help prevent the breach...

Re:They knew

[HiThere]

No. We can claim that they did not prevent the breach, but they may well have delayed it or made it more difficult.

That said, they clearly don't suffice. The executives and management should be held personally responsible for the time, effort, and financial damages that this breach caused to every single individual affected, including only those who had to spend time figuring out how to try to deal with it. At a reasonable hourly rate, say the average hourly rate of the corporation management (figured from their salary and their nominal working time).

Re:They knew

[MickyTheIdiot]

The corporate death penalty, i.e. the loss of charter, needs to be a thing. The possibility of all the stock becoming worthless would be a great tool in getting corporations to actually follow the law.

However since we have a congress that is OWNED by corporations there isn't a way for it to happen.

Re:They knew

[GLMDesigns]

Really?

I didn't read the article - but was their request for deregulation regarding security standards or in something else.

If it's something else then the request is irrelevant,

Re:They knew

[mi]

No. We can claim that they did not prevent the breach, but they may well have delayed it or made it more difficult.

We have no idea...

That said, they clearly don't suffice.

Not "clear" at all. When a tank's hull is breached by an enemy's shell, is it because the armor was too weak, or because it was too heavy for the tank to move faster? Which of the aspects should be improved — at the expense of the other?

The executives and management should be held personally responsible

Though I agree in this case, this is a dangerous line of thinking — not entirely unlike blaming a rape victim for wearing too short a skirt...

Re:They knew

[MickyTheIdiot]

The executives and management should be held personally responsible

Though I agree in this case, this is a dangerous line of thinking — not entirely unlike blaming a rape victim for wearing too short a skirt...

This is the worst simile I have EVER seen on Slashdot. That's saying a lot.

The corporate CxOs are NOT the victim in this scenario. The corporate worshipers on /. and the Internet love to tell us that the executives deserve huge pay packets because they are responsible. However in *every case* when something happens that hurts thousands of people they are always don't know what happened. Executives hold responsibility and deserve what they are paid or they don't know what is going on and they are overpaid. You can't have it both ways.

The CxOs were the benefactors of the malfeasance. Calling them rape victim is idiotic.

Re:They knew

[phantomfive]

They need to be made an example of by Congress,

That's always the wrong approach. It makes the mob of people feel good, even if they get the wrong person, but it doesn't cause any long-term change. What we need is a change in laws so this thing doesn't happen in the future. For one thing, they could have done a better job on security.

Re: They knew

[Anonymous Coward]

Nonsense. If giant soulless corporations didn't have to waste money fighting regulation for even minimal safety standards, they could have spent that $500,000 entirely in securing their data.

The above comment will be found on another board and even in other posts soon. Only there they won't be intended sarcastically.

Re:They knew

[Anonymous Coward]

Though I agree in this case, this is a dangerous line of thinking — not entirely unlike blaming a rape victim for wearing too short a skirt...

I think your analogy is a bit flawed. Let me expand...

EquiFax isn't the one wearing the short skirt. EquiFax is the pimp that forced their entire involuntary stable (those who's credit is checked) to wear short skirts as to be more attractive to the johns (those doing credit checks). The rapists (hackers) are certainly in the wrong but rape or no rape of the stable, the pimp is still in the wrong. The pimp forced the short skirts specifically to entice johns not as a fashion choice. Remember - nobody is in the stable by their own choice and nobody wears short skirts by their own choice.

This is another case of one party making a decision about risk where they will enjoy any positive consequences but other people will be left to deal with any negative consequences. The word for the phenomenon is 'externality'.

EquiFax was an accessory if not an accomplice to the crime so stop feeling sorry for them. The victims are the 'stable' who's information, stored against their choice, has been stolen.

Re:They knew

[Anonymous Coward]

The possibility of all the stock becoming worthless would be a great tool in getting corporations to actually follow the law.

And for ensuring that little people saving for retirement in 401K accounts lose everything and aren't able to retire

Re:They knew

[hlavac]

They need to be treated like a black man at a traffic stop.

What, smile at them and engage in light conversation about weather? That doesn't seem appropriate at all!

Re:They knew

[Xest]

Really? This sounds like stuff I'd expect vested interests to be lobbying for all the time regardless of the breach.

Is there any reason to think a firm like this wouldn't want to be deregulated regardless of whether the breach happened or not?

I'm not sure these two things are related, I think they were lobbying because they lobby for this sort of stuff all the time anyway. Is there any reason to think that lobbying for reduced regulation isn't the norm in this particular area of financial services as opposed to any other?

Re:They knew

[Calydor]

The Summary wrote:

While the company had broadly similar lobbying issues in those years, the liability matter was new in 2017.

Re:They knew

[muecksteiner]

You would be surprised how fast people start to care a lot more about the performance and character of the CxOs of the companies they have in their 401k accounts once a total, sudden loss due to criminal activity on part of said CxOs becomes a reality.

Re:They knew

[muecksteiner]

I would disagree with that. Nothing is going to change unless the crooks who are running that company are made examples out of. In person. In public. The only thing sociopaths like these vermin are actually afraid of is public humiliation, and loss of the hoard they are trying to amass. Nothing else works. These fuckers take pride in outsmarting a reasonable system. Time to up the stakes a bit.

Re:They knew

[Jason Levine]

The only thing people like this care about is money. If they can take an illegal action that nets them $1 billion and, if caught, pay a $1 million fine, they'll do it. If they can, they might even do it first and use some of the money to paying off... I mean lobbying politicians to make the action legal (or, at least, hard to prosecute).

Something along the lines of an Equifax breach should mean that the executives in charge of the company are fined 10 years' worth of their compensation package (including, but not limited to, stock options and salary). Maybe if a decade's worth of their valuation goes up in smoke, they'd get the hint.

Re:They knew

[Anonymous Coward]

Really? I didn't read the article - but was their request for deregulation regarding security standards or in something else. If it's something else then the request is irrelevant,

You know, there is an easy way for you to find the answer to your question.

Re:They knew

[mi]

The corporate CxOs are NOT the victim in this scenario.

The point I fully agreed — and continue to agree — with. In this case.

Executives hold responsibility and deserve what they are paid or they don't know what is going on and they are overpaid.

You've prevailed over a strawman you yourself erected. Congratulations.

The CxOs were the benefactors of the malfeasance.

What malfeasance? The only indication we have of them having done anything wrong so far is the fact, their database was stolen. You may as well denounce a burglarized homeowner for having insufficiently strong walls.

Calling them rape victim is idiotic.

Which is, probably, why I didn't call them that. What I said was that blaming a victim of a crime for it simply on the basis the crime took place is a dangerous line of thinking — because some times such victims are completely innocent. Not this time. But some times. Get it?

The person I was replying to stated, essentially, that the very fact of the breach proves — not "suggests", but proves — that the defensive measures were insufficient.

Re:They knew

[Anonymous Coward]

An outstanding reply to the earlier remark of 'PopeRatzo', because:

- It does not fire back with verbal abuse at 'PopeRatzo', who divided people into 'black men' and 'all other people' (including women of all colors)
- It specifies the proper engagement between people, something 'PopeRatzo' deliberately omitted but implied to be 'color-of-a-man-skin' related
- But best of all, it confronts the reader with what (s)he was thinking when reading the 'PopeRatzo' remark

Kudos hlavac !

Re:They knew

[Anonymous Coward]

I suspect they will be held accountable - will be fired - thrown from the plane at 30,000 feet - ........ and given a golden parachute.

Re:They knew

[Anonymous Coward]

Clearly the "defensive measures were insufficient" if there was a breach of this scale. The proof is in the fact that it fucking occurred!

Re:They knew

[sjames]

Or more likely, that they get a lot more careful where they stick their retirement funds, and perhaps start demanding contractual obligations on fund managers to steer clear of criminal corporations.

Re:They knew

[phantomfive]

I would disagree with that. Nothing is going to change unless the crooks who are running that company are made examples out of. In person. In public.

You're the kind of person who crucifies the innocent in public, then goes on with your day feeling good, while the real crooks continue what they are doing. But at least you did something, right?

There's a reason vigilante justice is bad, and it's because of people like you.

Re: They knew

[GuiRoo]

If you wanted to hold the responsible parties accountable, you'd be going after sysadmins and developers who incorrectly configured / executed their tasks. Which reader here is ready to go to jail for making a mistake in their day to day duties?

Re: They knew

[Anonymous Coward]

please elaborate how the equifax c-suite is innocent? people like you really part of the problem.

Re: They knew

[HiThere]

That may be reasonable ALSO. But many sysadmins don't have the right to control what they work on, so I can't be sure. It's definitely the case that the executives claimed responsibility while everything was (apparently) working well, and it appears that it was the executives who started selling their stock when the problem was detected. But even though the problem was detected, it wasn't fixed, so I suspect the sysadmins didn't have the right to fix it.

Of course, it might be quite reasonable to charge them as "accessories before the fact".

Re: They knew

[phantomfive]

please elaborate how the equifax c-suite is innocent?

Maybe they are, maybe they aren't: we have courts and processes for dealing with that, specifically created to avoid the problems of vigilantism.

Re: They knew

[PopeRatface]

What are ya, some kind of Nazi, or what? Here you are, insufficiently deferential to the Oppression of our Most Sacred Minority! I tell ya, the whole country is going to hell! Nothing but Nazis, I'm telling ya! Nazis!

Re: They knew

[GuiRoo]

Those execs sold a small percentage of their holdings, and they know this stuff is public record. The total amount sold is less than any one of them makes in a given year (also public record). If this was malicious, or their golden parachute, why not sell all of it? Or even most of it? None of this makes any sense. It was either their financial advisors executing on their behalf (who wouldn't have known), or they didn't know. Nothing else makes any logical sense.

Re: They knew

[HiThere]

You are right that I should be less definite that they had advance knowledge and took criminal advantage of it. Possibly the trades were scheduled ahead of time. Possibly they can be shown to not have known. (Though I'd be dubious about that. Gossip spreads in ways that aren't officially recorded.)

However it was their *JOB* to know that things were being managed well. That's how they justify their fancy salaries. I'm not going to let them off the hook for this, unless I consider them criminally negligent in their duties to the stockholders. (Actually, I do consider them so criminally negligent, whether they knew about the break in before they sold their stock or not.)

OTOH, it's also true that how I feel about them isn't going to affect what happens...and what I believe is going to happen is that if somebody in the company suffers significantly it's going to be a fall-guy who didn't volunteer for the role, and couldn't have prevented the incident.

Re:They knew

[DarthVain]

I doubt they knew about that specific breach that long ago (or that it happened that long ago), otherwise why announce it now?

It is more likely that they knew their security was a joke, and that they were very vulnerable and it was only a matter of time before something really bad happened.

The worst part is that they spend millions lobbying government to limit their breach liability when they could have been spending that money on some security folks to do an audit of their systems and fix their actual problem. The fact that the former is seen as a better alternative than the later is surely a sign of what is wrong in the world...

Investment

[Anonymous Coward]

If this investment had been poured into their actual infrastructure and IT staff salaries they probably would not have had a breach. Instead they funnel it into lawyers....unbelievable.

Re:Investment

[Archangel Michael]

Actually, the cost of doing business it is always cheaper for lawyers than just about anything else. Lawyers keep you out of Legal Danger (or at least are supposed to).

And until the Corporate board and the CxOs and the Shareholders are held accountable, nothing will actually change.

The only way to solve this problem is start charging the bigwigs at the top for criminal negligence of the corporate culture they foster. Followed by Corporate Death Penalty where the corporate charter is revoked. When shareholders are caught empty handed with nothing to show, they will DEMAND corporations uphold their due diligence and actually start protecting their data.

Lastly, I would suggest that the default nature of Credit is keeping it in a frozen state. It should take extraordinary effort to open credit account.

Re: Investment

[Anonymous Coward]

The only way this and future system cracks can be stopped is to unplug these systems. There is always a way in. Even the NSA with all it's resources cannot prevent successful intrusions.

Re:Investment

[Anonymous Coward]

If this investment had been poured into their actual infrastructure and IT staff salaries they probably would not have had a breach. Instead they funnel it into lawyers....unbelievable.

Well, that's what companies almost have to do with the government we have.

When we have so many damn laws and regulations that the average person commits three felonies a day, what do you expect large companies that will have enemies in politics to do?

If large companies don't cultivate friends in government, they're going to get fucked whether they deserve it or not.

That's a real consequence of a large, ubiquitous, overweening government.

And the more power you give to that government to "fix" it, the more incentive you create for any powerful person to engage in corrupting that government as much as possible - even well-intentioned companies are already forced to lobby the government just for self-presevation.

Re:Investment

[MickyTheIdiot]

The constant whine about regulations when as a country we pretty much allow our large corporations to get away with anything is rather tiresome.

Re:Investment

[Anonymous Coward]

Well, that's what companies almost have to do with the government we have.

Well, that's what governments almost have to do with the companies we have.

Not that the government represents the interests of the public body of biological humans any more than the bored of directors represents normal shareholders...

Re:Investment

[Anonymous Coward]

That's a real consequence of a large, ubiquitous, overweening government.

And the more power you give to that government to "fix" it, the more incentive you create for any powerful person to engage in corrupting that government as much as possible - even well-intentioned companies are already forced to lobby the government just for self-presevation.

Libertarian claptrap. This is a consequence of money ruling the political system. The government has to be able to enforce laws against the will of the lawbreakers. Therefore the government has to be the biggest, most powerful kid on the block. There is no way around it. It is a bargain whereby the government has a monopoly on force but is constrained by the will of the governed. At least that's how it's supposed to work.

Such a system will always be an attractive target for corruption. That's where the consent and will of the governed is supposed to come in, watching for corruption and dealing with it. I know that doesn't always or maybe often happen. But the solution is not to weaken the government to the point that no one bothers corrupting it. Once you shrink it to the size where you could drown it in a bathtub, someone will and you'll be left with a despot.

That just means they knew about the breach...

[Anonymous Coward]

... and that it happened a LONG time ago... long enough ago that they tried to get some legal protections from Congress before disclosing it.

This is criminal. Outright criminal. But, they're a bunch of jewish banksters, so they'll probably get another handout from Congress and a pat on the back for trying..

Re:That just means they knew about the breach...

[Kierthos]

I was under the impression that a company (at least in the U.S.) had 90 days from the point where they learned of the data breach to notify affected persons. It may vary from state to state though, as I know several states have laws about this. Apparently, the breach started in late May, but Equifax didn't discover it until July.

So they are technically within that 90 days. (Assuming that I'm not pulling that impression from some poorly remembered article.) Some of the execs are still shady as hell for selling stock right before the data breach was announced, and the company certainly doesn't come off as looking very good overall, even before the lobbying story broke.

But they were lobbying for this change before the data breach started. And they're hardly unique in lobbying Congress to make it harder for people to sue them.

Re:That just means they knew about the breach...

[jafiwam]

You are taking their word for when the breach started? LOLOLO ahaha ahaqhaa !! Aren't you cute.

cyberattack?

[Anonymous Coward]

Equifax disclosed the cyberattack

Welcome to the age of "cyber war", where every crap system connected to the internet can hide under the umbrella of an "attack" rather than face the consequences of a complete disregard for properly designed information security.

This will be proof that fewer regs are needed

[sandbagger]

If only they could have been freed from the yoke of these onerous, confusing regulations, this never would have happened!

Re:This will be proof that fewer regs are needed

[140Mandak262Jamuna]

Dont forget "job killing". Every focus group research done by them have shown the value of that adjective. Always say job killling

Re:This will be proof that fewer regs are needed

[Anonymous Coward]

>or to store it in a way that was predictable and insecure.

You're saying there was a piece of law or regulation that demands insecurity? I'd love to see you point to it.

Re:This will be proof that fewer regs are needed

[JackieBrown]

It's possible. What are their retention requirements? Do they have to be able to interface that data with other companies / government / people in a regulated determined time-frame?

Adding more laws is not always the best way and it's just a knee-jerk reaction. Did they already break any laws or regulation? It needs to be determined if the existing rules don't work because of how it's enforced before adding on top of those. There are already so many regulations regarding this industry that no newcomer will ever be able to enter this market.

In my city, touching your cell phone while driving is against the law - even if stopped at a traffic light. Unsafe and reckless driving was already illegal, did we really need to add another law on top of those? There is not a specific law against eating and driving, reading a book and driving, putting your make up on and driving.

Re:This will be proof that fewer regs are needed

[Anonymous Coward]

Different AC, but with how often they try to get backdoors legally-mandated, it wouldn't surprise me if there's already a law on the books like what the other AC is describing. That said, yeah, the onus is still on them to prove it.

Re:This will be proof that fewer regs are needed

[Anonymous Coward]

Yeah I am sure those credit history companies would never keep data on people if it weren't for that damned government making them.

Do people get more retarded every year?

Re:This will be proof that fewer regs are needed

[Required Snark]

Because your cell phone is a critical part of the financial infrastructure of the country you live in. Or is that an incorrect conclusion.

Re:This will be proof that fewer regs are needed

[Anonymous Coward]

It is extremely likely that it is a surplus of regulations that forced them to keep additional data that they did not need, or to store it in a way that was predictable and insecure. You really cannot say at this point until the postmortem is done. I think it's likely that more regulation is only going to exacerbate the problem, not solve it. But hey, jerk that knee.

Speaking of jerking that knee, how did you calculate the likelihood of your theory being correct?

Re:This will be proof that fewer regs are needed

[JackieBrown]

No - just an example of adding laws on top of laws rather than juts enforcing already existing ones.

Re:This was reported days ago

[Anonymous Coward]

Then why in the world would you bother coming here?

Re:This was reported days ago

[Killall -9 Bash]

Inertia.

Re: This was reported days ago

[Anonymous Coward]

Well, whipslash, that's because occasionally there is something interesting (actual news for nerds) posted here that's still worth reading. There aren't a lot of them, but once in awhile Slashdot has something useful. Thanks for asking, whipslash.

Just think...

[Gravis Zero]

Your data wouldn't have been given to criminals if they had invested that $500K in security.

Re:Just think...

[Anonymous Coward]

>Your data wouldn't have been given to criminals if they had invested that $500K in security.
No, the criminals would have had to pay for it like everyone else...... Let that sink in for a moment.

Re:Just think...

[fustakrakich]

Sorry, but they are the criminals. What they call a "breach", I would call a sale. Why should we believe this was an accident?

Re:Just think...

[markdavis]

>"Your data wouldn't have been given to criminals if they had invested that $500K in security."

Actually, according to the summary, they spent at least $2.6 MILLION dollars in just the last 2.75 years, alone. Imagine how much that money COULD have done if they had used it to hire a few good security engineers and made meaningful changes.

Re:Just think...

[CaptainDork]

Well said.

Security will not be historical subject until after serious litigation.

Re:Just think...

[tlhIngan]

Actually, according to the summary, they spent at least $2.6 MILLION dollars in just the last 2.75 years, alone. Imagine how much that money COULD have done if they had used it to hire a few good security engineers and made meaningful changes.

You guys are looking at it the wrong way. You're looking at it as a victim, you should look at it as what it brought them.

With this one breach, that $2.6M is now completely wasted - in fact, it's even worse since it's now achieving the opposite effect - instead of trying to buy reduced scrutiny, their failure to spend on security is working against their campaigning. Even worse, it's brought government scrutiny on all the credit reporting agencies, with increased regulation likely the result.

By failing to spend on security, Equifax has basically made life in their industry much harder for everyone. Ezperian and TransUnion should be applying peer pressure for making it much more expensive to do business now.because any law that comes down, any scrutiny that happens will apply equally to all three of them.

And financial institutions HATE government oversight.; When "too big to fail" banks started having government oversight as required by their bailout packages, they couldn't get rid of them fast enough.

That's how you're supposed to frame it. Protecting your data? You're not worth that much to them. But ensuring their future is free of government oversight and extra regulation? That's something that does affect them directly and the cost of doing business

Re:Just think...

[Zxern]

Awww you're so optimistic. Considering the stupidly short attention span of the average American, this will be long forgotten before any kind of law or regulation can even be written let alone brought up for a vote.

Re:Just think...

[Cederic]

I think it's reasonable to assume that Equifax spend significantly more than that on security professional employees, more than that on security consultants and service providers, substantially more than that on security infrastructure and probably around that much on audit for all of the above.

Re:This was reported days ago

[Anonymous Coward]

Then why are you even here, you dumb shit? To have a place to spew your digital diarrhea? GTFO.

how dumb can you get?

[Anonymous Coward]

Your data wouldn't have been given to criminals if they had invested that $500K in security.

you are beyond-redemption-stupid if you think they would have spent money on security

Sounds familiar

[smooth wombat]

I clearly remember the banks and Wall Street firms lobbying Bush and Congress not to implement any new regulations back in 2006. Their words were, more or less, any new regulations would kill their competitive nature on the world market. Trust us, we know what we're doing.

The following year we know what happened.

Now here we are again, with a very similar situation. Regulations are evil! Don't kill us with regulations, bro!

I can guarantee not a single executive at Equifax will go to jail or pay a fine. Further, every excuse imaginable will be given why requiring such breaches to be announced immediately should not be done.

In a few years, this will happen again and everyone will look around and ask, "How did this happen?"

Re:Sounds familiar

[Tablizer]

The USA is mostly a bribocracy at the federal level, plain and simple. Both parties are culprits. If you don't kiss up to those who give campaign donations, you get less campaign money and lose elections. It's legalized political prostitution and Americans should be ashamed of such a system.

Re:Sounds familiar

[Required Snark]

The people who run our economy act like meth freaks with rabies where meth == money and rabies == corporate greed.

Until there is a general understanding that big business is not a noble pursuit, but a socially sanctioned form of criminal activity, we will continue to suffer this kind of crap. The basic assumption should be that corporations always become corrupt and that the law exists to root out that corruption.

There must be accountability for organizations and the people in charge of those organizations. This means if you are in the executive suite or the boardroom and the company commits crimes that you will end up in jail and penniless. Nothing short of that will have any impact. Investors must also be put at risk; if the company goes over the line they should loose their entire investment. That way they will be keep an eagle eye on the management and keep them honest.

Note that this is exactly the opposite of our current system. The people at the top of the corporate pyramid pay themselves vast sums of money while they take insane risks so they can gouge even more money. When it all goes sour they keep their fortunes and investors and taxpayers pick up the tab. All this occurs at the same time the same companies engage in international tax avoidance schemes that might as well be evil magic.

Don't believe me? We are in a yet another bubble and the next crash will happen before 2020, and perhaps as early as next year. And like the last time corporate malfeasance will be the cause.

Hangin's too good for 'em

[Rick Schumann]

You think maybe Equifax is exemplar of all the other credit reporting agencies? I think they might be. I think there needs to be some corporate nutsacks put on the congressional anvil, with liberal application of the judicial sledgehammer over this, to ALL of them. It's bad enough that jackass businesses like Facebook and Google and ISPs are invading our privacy, but companies like these credit reporting agencies MUST BE ABOVE REPROACH AT ALL TIMES OR THEY ARE WORSE THAN USELESS. It is totally, completely unacceptable that this happened at all and it has to STOP.

Re:Hangin's too good for 'em

[Anonymous Coward]

If the govt. will not do it, I just hope they get sued into Chapter 7 liquidation. No more Equifax. It's the only solution that will result in real change.

Re:Hangin's too good for 'em

[bgalbrecht]

In the mean time, everyone should freeze their credit information at all 4 credit reporting companies (Equifax, Experian, Transunion and Innovis which is more for fraud detection), and when they need to unfreeze their credit information, only unfreeze it at the other companies and never unfreeze it at Equifax. Between lawsuits and being unable to provide credit information to lenders, they'll lose money.

regulation is always bad for business

[Revek]

Its normally quite good for the public, though you couldn't convince them of that since they get their swill from big media.

Re:regulation is always bad for business

[HiThere]

It's normally good for the public until regulatory capture happens. Then it continues to be slightly less bad for the public...but often only slightly.

Regulators need to be forbidden to accept payments from the groups they regulate not only while in office, but also after leaving. And that includes jobs.

Bastards ...

[Anonymous Coward]

These clowns want access to our data, with which broad reaching decisions about our lives will be made ... but they want to do it in such a way that they have no responsibilities or liabilities in the event they prove to be incompetent morons. Oh wait, they've just been proven to be incompetent morons.

Capitalism is inherently broken, because it assumes people aren't lying, greedy bastards; the problem is time and time again we see that isn't true. You can't have capitalism without regulation, because the free market is a lie, it can't address certain kinds of problems, and when companies are proved to be liars or incompetent it's the consumer who suffers. You have to assume all of the actors are gaming the system, and not stupidly assume the market will fix these things. Because gaming the system is what it is all about.

If Equifax wants access to the banking data of millions of people, it bloody well needs to be regulated the same as a fucking bank. If they don't wish to be regulated, then they have no fucking business accessing this data.

None of us ever signed up with Equifax, they've essentially co-opted our data. And then they tried to argue they shouldn't have any liability. Sorry, but if your business model is built around collecting my data without my consent -- financially sensitive data -- then you don't get to exempt yourself from having a legal requirement to safeguard that data.

Fucking corporate assholes. Sadly, I'm sure some Republicans are all about removing regulations, and if the consumer gets fucked, too bad. Capitalism can really only serve society if society has it on a very short leash.

I firmly think that every C*O in the nation and their families should be doxed to hell and beyond. If they're going to play fast and loose with our data, let's show them what that's like.

If Equifax wants to have this data and not be covered under regulations, Equifax needs to cease to fucking exist.

Re: Bastards ...

[GuiRoo]

The credit bureaus are regulated just like a bank. And how do you think they get their data? Your bank sends it to them. And the way the laws and regulations are currently written, it's not YOUR data. It may be data about you, but you do not own it. If you want to change something, change that.

Re: This was reported days ago

[Anonymous Coward]

The editors were fired years ago. Welcome to 2017, dice doesn't own this anymore.
Also, /. never broke much news.
And for like 10 years all stories have to live in the firehose until they get voted up.

I have the same combination on my luggage!

[xxxJonBoyxxx]

Until at least late 2016, there was this hardcoded into their mobile app (http://www.apkmonk.com/app/com.equifax/):

UtilitiesHandler.java
                static final String masterKey = "EqUiFaX2468";

Not quite "1...1!...2....2!..." but it's pretty darn close.

To be fair, I couldn't tell if it's actually ever used in the mobile app. It seems like the kind of intentionally stupid/obvious password-but-not-really-a-password string you'd leave hanging around in a file on the network if you were tuning your DLP. (The full Zip code of the company is 30309-2468 so the "plus 4" is probably where the ending came from.)

Re:I have the same combination on my luggage!

[Xyrus]

It's all a plot. Cause a massive leak and that forces everyone to freeze their credit reports. Charge $60 a pop to lock and unlock them. Bam, instant profit.

Re: This was reported days ago

[Anonymous Coward]

The parent comment was posted by an editor. Stay classy, Slashdot.

A side effect of everybody having your data

[Anonymous Coward]

We should just accept that the more of your information is stored on servers the higher the risk of it being harvested. Doesn't help that these companies withhold breeches for such a long time before even notifying anyone including the people affected. I won't take much action now, its too late to bail out a ship already sinking.

My question about this mess is...

[Stomper_Stoddard]

They said this data breach took place from May through July. How exactly does one miss terabytes, possibly petabytes of data being transferred to an IP address outside of your network for 3 months? I mean to me this sounds like either the hackers were god like in their ability to hide what they were doing, or the people whose job it was to prevent these things from happening, simply didn't give a shit.

Re:My question about this mess is...

[Ol Olsoc]

They said this data breach took place from May through July. How exactly does one miss terabytes, possibly petabytes of data being transferred to an IP address outside of your network for 3 months? I mean to me this sounds like either the hackers were god like in their ability to hide what they were doing, or the people whose job it was to prevent these things from happening, simply didn't give a shit.

Hiring people to monitor this stuff costs money, and why punish the shareholders with a cost cernter? This will all self correct anyhow, amirite?

Re:My question about this mess is...

[Anonymous Coward]

Info on-line indicates Equifax IT was outsourced with access to all the data.
This stupid stunt of outsourcing was sure to become a shipwreck at some point.
I hope those bastard CEO's burn in hell after we get our hands on them !!!

Re:My question about this mess is...

[Anonymous Coward]

They said this data breach took place from May through July. How exactly does one miss terabytes, possibly petabytes of data being transferred to an IP address outside of your network for 3 months? I mean to me this sounds like either the hackers were god like in their ability to hide what they were doing, or the people whose job it was to prevent these things from happening, simply didn't give a shit.

Hiring people to monitor this stuff costs money, and why punish the shareholders with a cost cernter? This will all self correct anyhow, amirite?

A 150M SSN are far, far away from terabytes. Let alone petabytes. The data trasnfer would probably fall under the noise.

Well duh!

[Ol Olsoc]

Regulations are bad and regressive! Business always self polices itself better, and the invisible hand of the free market is never wrong, and always self correcting.

If there were no regulations, this would never have happened, and we would all enjoy perfect internet security.

Re: Well duh!

[Anonymous Coward]

Donald? Is that you in there?

Re:Well duh!

[Anonymous Coward]

... hand of the free market is never wrong ...

The "invisible hand" means that buyers benefit despite the greed, dishonesty and (economic) power of the sellers. It does not mean, as corporatists like to claim, that the economic power of the buyers is greater than the greed, dishonesty and (economic) power of the sellers.

Normal behaviour

[Anonymous Coward]

... Equifax has also lobbied Congress and regulatory agencies on issues ...

Corporations minimize/externalize expenses and regulations are another way of achieving that. How much money did other credit agencies spend lobbying for less regulation? Governments need to post lists naming the regulations that lobbyists/corporations want to delete. I doubt there will be any way to avoid the "less regulation will help our customers" propaganda that's been proven false every time it was applied to the finance/credit industry.

Wasted Money

[Anonymous Coward]

Imagine what $500k could buy for labor, software, maintenance and expertise? F-tards. I'm so sick of stupid (corrupt) people in leadership positions.

Still Gonna Happen

[mschwanke97402]

Laying off Credit Bureaus is part of a larger bill in hearings right now to reduce regulations and “make American business competitive”. Check it out.

Question on "Lobbying"

[ytene]

Sorry that this is a bit of a tangential question to the OP...

I notice that the amount of "lobbying" being reported in the media seems to be on the rise again, perhaps after a bit of a post-2008 lull.

However, it really isn't clear what is permitted as "legal" lobbying and what is considered "illegal"? Is this in-person requests for meetings to put forward a case? Is this industry-funded "research" offered up as candidate for government policy? Is this the offer of all-expenses-paid "junkets" to take law-makers on expensive trips to "see for themselves" [and be wined and dined in the process].

Forgive the cynicism, but I've reached a point where any time I read "lobbying" my brain substitutes "illegal bribery"... I wondered if anyone could point me at guidelines that help show what is permitted vs not permitted, and/or where this is tracked and monitored for compliance?

Given that the two places with the most lobbyists are Washington and Brussels, it is getting increasingly difficult to see how regular citizens are being properly represented at the "legislative table". Interested in any analysis of that, too...

Re:Question on "Lobbying"

[MoarSauce123]

There should be no lobbying where money changes hands (like Boehner did when handing out checks from the tobacco lobby on the House floor) and all and every lobbying activity has to be publicly announced at least a week before it takes place. Can't have democracy without transparency.

Re:Question on "Lobbying"

[ytene]

I think we can agree on that. However, let me give you a different scenario. Suppose you are a Senator or Congressperson and I come to you and say, "Look, there is a small trade association meeting taking place in a couple of months. All in the public eye and nothing behind closed doors. We'd like you to come along given your role on [such and such] committee. We're going to be based at the Florida Disney resort, in the main resort hotel. We're happy to cover the cost of your flights and because this takes place during a school holiday, you would be welcome to bring your family and let them loose in Disney while you're working with us. The meeting is scheduled to take one or two days, but we're going to book for a week, just in case..." [Nudge, nudge, wink, wink...]...

Now, no money has changed hands. I haven't "given" you a dime. Instead what I've done is given you a week's free holiday in Florida Disney in return for a day of intense lobbying at something I want you to agree to... And the best bit is, I didn't lobby you at all. I just invited you to attend an industry conference.

A-holes!

[MoarSauce123]

They should have spent the 500,000$ on system security instead of lobbying. We all would be better off.

So wait a minute

[kilodelta]

They'd rather spend half a million dollars on lobbying versus spending it on InfoSec? Talk about perverted priorities.

Re:So wait a minute

[The123king]

They were quite obviously trying to shut the barn door after the horse bolted. No point spending money of infosec when all the info has already been stolen.

Re:This was reported days ago

[Anonymous Coward]

Which is slower? Slashdot editors reporting news or Equifax reporting the data breach? The editors are garbage and should be fired. Slashdot is about as worthless as the site to check if your data was compromised in the Equifax data breach.

Yeah, you're totally not getting your money's worth on this site!

Re: This was reported days ago

[Anonymous Coward]

Well, whipslash, that's because occasionally there is something interesting (actual news for nerds) posted here that's still worth reading. There aren't a lot of them, but once in awhile Slashdot has something useful. Thanks for asking, whipslash.

So read the articles that interest you and don't read the ones that don't...